CVE-2019-9236

CVE-2019-9236 affects Android 10 and is tied to the NFC subsystem. The root cause is a missing bounds check that enables an out-of-bounds read, leading to local information disclosure. Exploitation requires user interaction, and the impact is bounded to information disclosure with no remote code ...

CVE-2019-9294

CVE-2019-9294 affects the Android 10 libstagefright component, describing an out-of-bounds read due to a missing bounds check. This vulnerability can lead to remote information disclosure with user interaction required for exploitation; no explicit in-the-wild exploit details are provided in the ...

CVE-2019-9296

CVE-2019-9296 affects Android 10 and is described as an NFC-related out-of-bounds read that can disclose information locally without execution privileges. The root cause is a missing bounds check in NFC handling, with exploitation requiring user interaction. Impact is information disclosure (conf...

CVE-2019-9319

CVE-2019-9319 affects Android 10 media stack (libavc) where a missing variable initialization in the library can lead to remote information disclosure without extra execution privileges. Exploitation requires user interaction. The Android 10 security release notes state these issues are addressed...

CVE-2019-9348

Summary of CVE-2019-9348 (Android 10, libstagefright) : The vulnerability is a resource exhaustion issue in the Android Media Framework (libstagefright) caused by improper input validation. It could allow a remote denial of service without extra privileges, with user interaction required to explo...

CVE-2019-9351

CVE-2019-9351 affects the Android 10 Framework, specifically a bypass in SyncStatusObserver that allows local information disclosure by failing to enforce a permission check between user profiles. Exploitation is described as requiring no user interaction and provides only local access with parti...

CVE-2019-9393

CVE-2019-9393 affects Android 10 Bluetooth, where a missing bounds check in the Bluetooth stack can allow a remote denial-of-service without user interaction. The impact is a DoS with high CVSS 3.1 base (HIGH) and network attack vector, though exploitation details are not provided in the provided...

CVE-2019-9471

CVE-2019-9471 affects Android kernel code abc-pcie.c, specifically in set_outbound_iatu, where a missing bounds check can cause an out-of-bounds write. This leads to local elevation of privilege with system execution privileges required; exploitation does not require user interaction. Public refe...

CVE-2020-0011

CVE-2020-0011 affects the FPC Fingerprint TEE in Android kernels. The description in multiple sources states an out-of-bounds write in get_auth_result of fpc_ta_hw_auth.c due to a missing bounds check, enabling local elevation of privilege with System-level privileges required. Exploitation is de...

CVE-2020-0125

CVE-2020-0125 affects Android 11 media framework (mediadrm). The issue is a missing bounds check causing an out-of-bounds read that can disclose local information without extra privileges and without user interaction. Multiple sources corroborate this, listing mediadrm as the vulnerable component...

CVE-2020-0127

CVE-2020-0127 affects Android 10 via the Media/Audio framework: an out-of-bounds read in AudioStream::decode (AudioGroup.cpp) caused by a missing bounds check. This can lead to information disclosure in the phone process without extra execution privileges; exploitation reportedly requires user in...

CVE-2020-0149

CVE-2020-0149 describes a local info-disclosure flaw in Android 10 caused by an out-of-bounds read in btu_hcif_mode_change_evt (btu_hcif.cc). The issue allows local attackers with System privileges to access information without user interaction. Affected: Android 10 devices; vector is local. The ...

CVE-2020-0196

CVE-2020-0196 affects Android 10 in the Bluetooth stack. In RegisterNotificationResponse::GetEvent, improper input validation can cause an abort, resulting in remote denial of service over Bluetooth with no extra privileges and no user interaction required. This is described in Android Pixel secu...

CVE-2020-0199

CVE-2020-0199 affects Android 10 with a race-condition in TimeCheck.cpp TimeCheckThread::threadLoop that can cause use-after-free and local information disclosure, potentially gaining system privileges. The description specifies no user interaction required. Connected sources repeat the same deta...

CVE-2020-0218

CVE-2020-0218 affects Android 10, describing a race-condition in loadSoundModel and related code in SoundTriggerHwService.cpp that can cause an out-of-bounds write. This leads to local elevation of privilege with no additional execution privileges required; exploitation reportedly requires no use...

CVE-2020-0312

CVE-2020-0312 affects Android 11 Battery Saver. It describes a permission bypass caused by an unsafe PendingIntent that could disclose local information; exploitation details are not provided, and no in-the-wild status is stated. The vulnerability is mitigated by Android 11 security updates (patc...

CVE-2020-0325

CVE-2020-0325 affects Android 11 with a vulnerability in the NFC subsystem where a missing bounds check can lead to local information disclosure and potential system execution privileges. The issue is triggered without user interaction and is exploitable with local access; impact is limited to in...

CVE-2020-0330

CVE-2020-0330 relates to the Android 11 ecosystem. The affected component is the iorap path, where a memory corruption via a use-after-free condition could be triggered locally. The documented impact is local escalation of privilege and code execution with System privileges, with exploitation not...

CVE-2020-0331

CVE-2020-0331 affects Android 11, describing a permissions bypass in Settings that can lead to local disclosure of the device IMEI. Exploitation is local, with low attack complexity, requiring LOW privileges and no user interaction. The issue is documented across multiple sources (NVD, Red Hat, P...

CVE-2020-0363

CVE-2020-0363 affects Android 11 libmedia and can cause resource exhaustion leading to remote DoS. Exploitation requires user interaction (per CVSS3.1); CVSS2 indicates network access with partial availability impact. Public documents identify the issue as improper input validation in libmedia. A...

CVE-2020-0428

CVE-2020-0428 describes a race-condition in CamX code that enables a use-after-free vulnerability, leading to local escalation of privilege to SYSTEM level with no user interaction. Affected software is Android kernel camera components (CamX). The NVD entry lists CVSS2 as 4.4 (LOCAL, MEDIUM) and ...

CVE-2020-0497

Technical details about CVE-2020-0497 are not provided in the supplied documents beyond the basic Android biometric disclosure information. Monitor for updates for any new specifics on affected components, affected versions, impact, and remediation.

CVE-2020-11604

CVE-2020-11604 affects Samsung mobile devices running P (9.0) and Q (10.0) with TEEGRIS; the issue is an out-of-bounds read in the MLDAP Trustlet. Connected records confirm the vulnerability details and Samsung’s reference ID SVE-2019-16565. Impact details across sources indicate leakage of infor...

CVE-2020-25051

CVE-2020-25051 affects Samsung mobile devices running Android P (9.0) and Q (10.0). The vulnerability permits bypassing Factory Reset Protection (FRP) via AppInfo, as described across multiple sources (NVD entry, Red Hat advisory, NCSC summary) with Samsung’s ID SVE-2020-17758. The exact affected...

CVE-2020-25053

CVE-2020-25053 affects Samsung mobile devices running Android Q (10.0) on Exynos9830. Root cause: RKP permits arbitrary code execution. Impact: remote code execution with high severity (CVSS v3.1 base 9.8, network access, no user interaction). Exploitation details are not provided in the document...

CVE-2020-25065

CVE-2020-25065 affects LG mobile devices running Android 4.4–10. The issue is that an obsolete API enables key logging, leading to potential confidentiality impact (C:H) with no integrity/availability impact. Root cause described as use of an obsolete API; CVSS:3.1 base score 7.5 (Network attack ...

CVE-2020-25283

CVE-2020-25283 affects LG mobile devices running Android 8.x–10. The issue is described as the BT Manager bypassing intended access restrictions on a certain mode. The connected records indicate the affected product family (LG Android devices) and component involved (BT Manager), but do not provi...

CVE-2020-27021

CVE-2020-27021 is an Android 11 vulnerability documented in the Pixel security bulletin under the System component with type “ID” (Information disclosure) and moderate severity. The issue is described elsewhere as an out-of-bounds read in avrc_ctrl_pars_vendor_cmd of avrc_pars_tg.cc, enabling loc...

CVE-2020-27032

In CVE-2020-27032, a missing permission check in getRadioAccessFamily() of PhoneInterfaceManager.java allows a local attacker to read privileged radio data on Android-11, potentially leading to information disclosure without user interaction. Affected component is the Android framework (PhoneInte...

CVE-2020-35552

CVE-2020-35552 involves the GPS daemon on Samsung mobile devices with non-Qualcomm chipsets (O 8.x, P 9.0, Q 10.0). The vulnerability arises from an incorrect configuration file in the GPS service, allowing an attacker to obtain sensitive location information. Connected records confirm the affect...

CVE-2021-0358

In netdiag, a command-injection flaw exists due to improper input validation. This could enable local escalation to System privileges on Android devices (Android-10/Android-11) with no user interaction required. The issue is described across multiple sources (e.g., NVD/Red Hat) and is associated ...

CVE-2021-0376

CVE-2021-0376 affects Android 11 via MediaProvider.java (checkUriPermission) with a permissions bypass that enables local escalation of privilege without extra execution privileges. The vulnerability is described as an Elevation of Privilege (EoP) issue; affected component is Media framework/Andr...

CVE-2021-0378

CVE-2021-0378 is a heap-based out-of-bounds read in pvmp3_getbits.cpp:getNbits affecting Android 11 (Media framework). The vulnerability permits remote information disclosure without extra execution privileges; exploitation requires user interaction per the NVD entry. CVSS details: CVSS v3.1 base...

CVE-2021-0407

CVE-2021-0407 affects the clk driver, with an out-of-bounds write caused by an incorrect bounds check. This can lead to local escalation of privilege with System execution privileges needed; exploitation reportedly requires no user interaction. Public references indicate a patch ID ALPS05479659 (...

CVE-2021-0498

The CVE-2021-0498 entry concerns Android’s memory management driver, where a double free can cause memory corruption leading to local escalation of privilege with no required user interaction. The issue is described consistently across multiple connected sources (including NVD, Red Hat, CNVD, PRI...

CVE-2021-0613

CVE-2021-0613 affects MediaTek’s asf extractor component. It describes an out-of-bounds read caused by an incorrect bounds check, enabling local information disclosure without extra privileges or user interaction. A patch/issue reference is ALPS05489178 (MediaTek bulletin). Exploitation details (...

CVE-2021-0632

CVE-2021-0632 describes an out-of-bounds read in the Mediatek wifi driver caused by a missing bounds check. The affected component is the wifi driver (Mediatek). Exploitation could enable remote information disclosure to a proximal attacker under certain build conditions, with no user interaction...

CVE-2021-0655

CVE-2021-0655 affects the mdlactl driver and is caused by a memory corruption due to an incorrect bounds check. The vulnerability could allow local privilege escalation to SYSTEM with no user interaction required. Impact is described as partial/complete control for the attacker on the affected sy...

CVE-2021-0667

CVE-2021-0667 describes a memory corruption via a use-after-free in the apusys component. The issue could allow local escalation of privilege with System execution privileges required, and no user interaction is needed. The vulnerability is associated with MediaTek-derived components (patch ID: A...

CVE-2021-25411

CVE-2021-25411 affects the RKP API prior to Samsung SMR JUN-2021 Release 1, where improper address validation allows a root, local attacker to write read-only kernel memory. The connected documents do not provide explicit affected products/versions beyond this description, nor explicit remediatio...

CVE-2021-25470

CVE-2021-25470 affects TEEGRIS Secure OS prior to SMR Oct‑2021 Release 1. The issue is an improper caller check logic in the SMC call that can be used to compromise the Trusted Execution Environment (TEE). Impact is described as TEE compromise; no exploit details provided in the documents. Mitiga...

CVE-2021-25472

The CVE-2021-25472 entry concerns an improper access control vulnerability in BluetoothSettingsProvider for Samsung SMR releases. Affected component: BluetoothSettingsProvider prior to SMR Oct-2021 Release 1. Condition: an untrusted application can overwrite certain Bluetooth information due to w...

CVE-2021-25481

The CVE-2021-25481 entry concerns Samsung Exynos CPU (Exynos CP) booting driver. It reports improper error handling that allows local attackers to bypass the Secure Memory Protector of Exynos CP Memory prior to SMR Oct-2021 Release 1. Public references in the provided documents corroborate the ex...

CVE-2021-25503

CVE-2021-25503 is an improper input validation vulnerability in Samsung HDCP prior to SMR Nov-2021 Release 1 that enables arbitrary code execution. Affected component: HDCP; root cause: input validation weakness. Local attack vector with low complexity and no authentication required (per CVSS). I...

CVE-2022-33700

CVE-2022-33700 affects Samsung TelephonyUI, specifically the putDsaSimImsi path. The vulnerability arises from inadequate protection of sensitive information in TelephonyUI, enabling a local attacker to read IMSI values via logs. The issue is rooted in information disclosure within the putDsaSimI...

CVE-2022-38688

CVE-2022-38688 : The telephony service contains a missing permission check that enables local information disclosure without additional execution privileges. The NVD entry assigns a CVSS v3.1 base score of 5.5 (Local exploit, Low complexity, Low privileges required; Confidentiality impact: High)....

CVE-2022-39115

CVE-2022-39115 relates to a missing permission check in the Music service, allowing a local attacker to cause a denial of service without extra privileges. Affected component is the Music service; root cause is insufficient authorization before performing sensitive actions. Impact stated as local...

CVE-2022-39116

The CVE-2022-39116 entry affects the sprd_sysdump driver, where a missing bounds check leads to an out-of-bounds write. The underlying issue can cause local denial of service in the kernel. Multiple sources (NVD, Red Hat, CVE listing) confirm the same description; exploitation details or in-the-w...

CVE-2022-47478

Affected software: telephony service. Root cause: missing permission check leading to potential local information disclosure. Impact: local information disclosure without additional execution privileges; confidentiality impact HIGH, as per CVE entry. Exploitation status: not described in the prov...

CVE-2022-47489

CVE-2022-47489 affects UNISOC chipsets’ soter service module, where a missing bounds check can trigger an out-of-bounds write. This flaw may allow local denial of service with System execution privileges required. Documents in connected sources corroborate the issue as a boundary-check deficiency...