CVE-2022-39115

CVE-2022-39115 relates to a missing permission check in the Music service, allowing a local attacker to cause a denial of service without extra privileges. Affected component is the Music service; root cause is insufficient authorization before performing sensitive actions. Impact stated as local...

CVE-2022-39116

The CVE-2022-39116 entry affects the sprd_sysdump driver, where a missing bounds check leads to an out-of-bounds write. The underlying issue can cause local denial of service in the kernel. Multiple sources (NVD, Red Hat, CVE listing) confirm the same description; exploitation details or in-the-w...

CVE-2022-47478

Affected software: telephony service. Root cause: missing permission check leading to potential local information disclosure. Impact: local information disclosure without additional execution privileges; confidentiality impact HIGH, as per CVE entry. Exploitation status: not described in the prov...

CVE-2022-47489

CVE-2022-47489 affects UNISOC chipsets’ soter service module, where a missing bounds check can trigger an out-of-bounds write. This flaw may allow local denial of service with System execution privileges required. Documents in connected sources corroborate the issue as a boundary-check deficiency...

CVE-2022-48236

CVE-2022-48236 concerns the MP3 encoder in UNISOC chipsets. A missing bounds check can cause an out-of-bounds read, leading to local denial of service with system‑level privileges required. Reported base metrics (CVSS 3.1: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H; base score 4.4) indicate local access...

CVE-2022-48238

CVE-2022-48238 affects UNISOC chipsets’ Image filter module. The root cause is a missing bounds check that enables out-of-bounds writes, leading to local denial of service with System execution privileges required. Documents consistently describe the impact as local DoS with high availability imp...

CVE-2022-48240

The CVE-2022-48240 entry concerns the UNISOC camera driver. Affected component: camera driver in UNISOC chipsets. Root cause: missing bounds check causing an out-of-bounds write. Impact: local denial of service with System execution privileges required; confidentiality/integrity are not affected ...

CVE-2022-48249

CVE-2022-48249 affects UNISOC Chipsets’ audio service, where a missing permission check in the audio service could allow local escalation of privileges with no additional execution privileges. Base CVSS v3.1 score is 7.8 (HIGH); vectors indicate Local Privilege Escalation with Low complexity and ...

CVE-2022-48378

CVE-2022-48378 concerns the engineermode service in UNISOC chipsets, where a missing permission check enables local denial of service. Attack vector is local, requiring low privileges with no user interaction. The provided documents consistently describe the issue as a local DoS without noting re...

CVE-2022-48387

The CVE-2022-48387 issue affects the apipe driver (notably in UNISOC chipsets), caused by a missing bounds check that enables an out-of-bounds write. This leads to local denial of service with System execution privileges required. Publicly detailed exploit information, affected versions, and conc...

CVE-2023-20710

The CVE-2023-20710 entry concerns the MediaTek keyinstall component, where an out-of-bounds read can occur due to a missing bounds check. This vulnerability could lead to local information disclosure with system-level privileges required for exploitation, and exploitation reportedly does not requ...

CVE-2023-20719

The CVE-2023-20719 issue affects the pqframework. It describes an out-of-bounds read caused by a missing bounds check, potentially enabling local information disclosure with high confidentiality impact and requiring system privileges, with no user interaction needed. Mitigation/Remediation: Patch...

CVE-2023-20760

CVE-2023-20760 affects MediaTek devices via the apu component, with an out-of-bounds write caused by a missing bounds check. This can enable local escalation of privilege to System execution level without user interaction. Exploitation details are not provided in the documents, but a patch (ALPS0...

CVE-2023-20783

CVE-2023-20783 describes an out-of-bounds write in the keyinstall component due to a missing bounds check, enabling local privilege escalation with System-level privileges; exploitation is reported as possible without user interaction. The available references consistently cite this issue and a p...

CVE-2023-20787

MediaTek thermal module vulnerability CVE-2023-20787 is a use-after-free caused by a race condition in the thermal management code. It could allow local escalation to SYSTEM privileges without user interaction. Patch ALPS07648734 is noted; no exploitation details are provided in the sources. Refs...

CVE-2023-20793

CVE-2023-20793 affects MediaTek devices via the apu module, causing memory corruption from a missing bounds check. This can permit local denial of service with SYSTEM privileges, without user interaction. The issue is tied to firmware/driver code (apu) and has a patch identified as ALPS07767818. ...

CVE-2023-21299

CVE-2023-21299 affects Android’s Package Manager, allowing an attacker to determine whether an app is installed via a side‑channel information disclosure. Impact: local information disclosure without extra privileges or user interaction. The vulnerability is described in multiple sources (includi...

CVE-2023-21304

CVE-2023-21304 describes an information-disclosure flaw in Android’s Content Service that can reveal whether an app is installed without query permissions, via a side-channel. The issue allows local information leakage without extra execution privileges and does not require user interaction to ex...

CVE-2023-21311

CVE-2023-21311 describes an information-disclosure vulnerability in Android Settings where a permissions bypass could let a secondary user control private DNS settings. Exploitation is local (ATT&CK-like, not remote), requires no user interaction, and could disclose private information without ad...

CVE-2023-21316

CVE-2023-21316 affects Google Android: an information-disclosure side channel in content that lets an app determine whether another app is installed without query permissions. Local attack with no user interaction; no explicit exploit details or affected versions are provided in the documents. Re...

CVE-2023-21338

CVE-2023-21338 affects Android’s Input Method. The issue is a side-channel information disclosure that lets an app determine whether another app is installed without query permissions, enabling local elevation of privilege with no additional execution privileges required. The Android 14 security ...

CVE-2023-21339

CVE-2023-21339: Affects Minikin in Android. The vulnerability enables triggering an ANR through a malicious message, caused by resource exhaustion, leading to remote Denial of Service with no additional privileges and no user interaction required. Public details specify the issue but do not provi...

CVE-2023-21341

CVE-2023-21341 concerns Android’s Permission Manager, where a missing permission check can bypass required permissions, enabling local elevation of privilege. The issue is described as a local, low-privilege escalation with no user interaction required. Affected product/area: Android components r...

CVE-2023-32858

The CVE-2023-32858 entry concerns the GZ module (MediaTek context) with a missing data erasing causing local information disclosure. Root cause is not clearly detailed beyond the data erasure gap; the impact states local information disclosure with System execution privileges required, and exploi...

CVE-2023-32882

The CVE-2023-32882 entry relates to memory corruption in the battery module of MediaTek-based devices. The vulnerability arises from a missing bounds check in the battery component, enabling local escalation of privilege with System execution privileges required and no user interaction needed. Af...

CVE-2023-38468

CVE-2023-38468 documents a vulnerability in the urild service where a missing bounds check enables an out-of-bounds write. The consequence is local denial of service with System execution privileges needed. Public sources describe similar terms across multiple feeds (NVD/Red Hat/CVE records). Aff...

CVE-2023-40635

CVE-2023-40635 affects the linkturbo component and is caused by a missing permission check, enabling local privilege escalation with no extra execution privileges required. The vulnerability is reported across multiple sources (NVD, Red Hat, CVE lists) with a high impact (C:H, I:H, A:H; AV:L, PR:...

CVE-2023-40646

CVE-2023-40646 affects UNISOC chipsets’ Messaging component where a missing permission check could allow local information disclosure without requiring additional execution privileges. The NVD entry reports a CVSS v3.1 base score of 5.5 (Impact: Confidentiality High; Privileges Required Low; Atta...

CVE-2023-42724

CVE-2023-42724 concerns an out-of-bounds read in the GPU driver that could enable local denial of service with system execution privileges. Public details consistently describe the flaw as a bounds-check failure in the GPU driver, with patched mitigations referenced by Apple for iOS/iPadOS. Explo...

CVE-2023-48355

In CVE-2023-48355, the issue is a missing bounds check in the jpg driver, leading to an out-of-bounds write. The impact is locally exploitable with SYSTEM privileges required and can cause denial of service (availability impact high) while confidentiality and integrity are not affected. Public re...

CVE-2023-48358

CVE-2023-48358 is an out-of-bounds write in the DRM driver caused by a missing bounds check, leading to local denial of service with SYSTEM privileges. Affected component: DRM driver (noted in Red Hat/NVD records; associated with Unisoc chipsets per CNNVD). CVSS v3.1 metrics indicate a MEDIUM bas...

CVE-2024-20075

CVE-2024-20075 affects the eemgpu component, where a missing bounds check allows a possible out-of-bounds write. This could enable local privilege escalation with System execution privileges required; exploitation does not require user interaction. Patch ALPS08713302 is referenced (MSV-1393). No ...

CVE-2024-20096

The CVE-2024-20096 issue concerns the m4u component in MediaTek silicon/chips, where a missing bounds check allows an out-of-bounds read. Impact stated across sources includes local information disclosure with the potential for system-level execution privileges required; exploitation is not depen...

CVE-2024-20112

CVE-2024-20112 affects the isp component, with a missing bounds check causing an out-of-bounds read. The issue can lead to local denial of service and allows system execution privileges; exploitation requires user interaction. A fix is available as Patch ID ALPS09071481 (Issue ID MSV-1730). Conne...

CVE-2025-48564

CVE-2025-48564 affects Android Framework components and is caused by a race-condition that enables an attacker to bypass intent filters, leading to local escalation of privilege with no extra execution privileges or user interaction required. Multiple connected sources describe this as a local Eo...

CVE-2026-0044

CVE-2026-0044 affects the UBSan throwing runtime implementation (ubsan_throwing_runtime.cpp) across multiple functions. The vulnerability is caused by an integer overflow, which can crash the system and result in a remote denial of service. Exploitation requires network access with low attack com...

CVE-2026-0065

CVE-2026-0065 is a local elevation of privilege vulnerability in the Android Framework component, specifically a logic error in the areBackgroundActivityStartsAllowed method of BackgroundLaunchProcessController.java that permits unintended background activity launches. Exploitation requires User-...

CVE-2014-9789

The CVE-2014-9789 issue affects the Qualcomm arch/arm/mach-msm/qdsp6v2/msm_audio_ion.c code in Android on Nexus 5 prior to the 2016-07-05 patch level. The vulnerability stems from insufficient validation of parameters in the (1) alloc and (2) free APIs, enabling a crafted application to gain priv...

CVE-2014-9898

CVE-2014-9898 affects Android on Nexus 5 and Nexus 7 (2013) devices due to a flaw in arch/arm/mach-msm/qdsp6v2/ultrasound/usf.c where input parameters are not properly validated. This enables a crafted application to obtain sensitive information. The issue is associated with Android internal bug ...

CVE-2014-9945

CVE-2014-9945 describes an Improper Authorization vulnerability in the TrustZone component on Android releases from CAF that use the Linux kernel. The issue affects TrustZone/CAF Android builds and is described as potentially existing within the TrustZone security boundary. From the CVSS data, th...

CVE-2014-9948

CVE-2014-9948 is described as an Improper Validation of Array Index vulnerability in TrustZone across CAF Android releases that use the Linux kernel. The affected component is TrustZone; the root cause is improper validation of an array index. The CVSS3 metrics indicate a HIGH-severity, with a ba...

CVE-2014-9964

Technical details about CVE-2014-9964 (affected components, root cause, affected versions, exploitability, remediation) are not publicly provided in the connected documents. Monitor for updates from official sources (NVD, Android bulletins) for specifics.

CVE-2015-3833

CVE-2015-3833 affects Android up to version 5.1.1 (LMY48I). Root cause is in ActivityManagerService.getRunningAppProcesses, allowing a crafted app to bypass getRecentTasks restrictions and reveal the foreground app name. Public descriptions across sources confirm the flaw exists in Android before...

CVE-2015-6601

CVE-2015-6601 affects libstagefright in Android up to version 5.1.1 LMY48T. A crafted media file could cause memory corruption in mediaserver, allowing remote code execution or a denial of service. The issue is addressed by patches in Android 5.1.1 (LMY48T) and later via the October 2015 Nexus/An...

CVE-2015-8889

CVE-2015-8889 concerns the aboot implementation in Qualcomm components within Android on Nexus 6P devices, prior to the 2016-07-05 patch. The description notes that the recovery PIN feature is omitted, with impact and attack vectors listed as unspecified. Connected CNVD-2016-04846 and related CNV...

CVE-2015-9030

CVE-2015-9030 describes an authentication bypass in Android CAF builds that use the Linux kernel, via misused Hypervisor API. Affected: Android devices with CAF/Linux Kerenel stack; vulnerable component: Hypervisor API. Root cause: improper handling of Hypervisor API calls enabling bypass of auth...

CVE-2015-9039

Summary: CVE-2015-9039 affects the Qualcomm eMBMS component in Android CAF builds that use the Linux kernel. The root cause is an assertion that can be reached by a sequence of downlink messages in eMBMS, enabling a potential unauthorized operation. The vulnerability has a high/critical impact pr...

CVE-2015-9068

CVE-2015-9068 affects Qualcomm products with Android CAF builds using the Linux kernel. The root cause is improper validation of an argument to a mink syscall, as described in the CVE description. The entry is mapped to a highly critical impact profile (network attack vector, no user interaction,...

CVE-2016-10237

CVE-2016-10237 concerns Android/CAF Linux kernel handling of shared content protection memory, passed as the secure camera memory buffer to a trusted application (TA). The description indicates the TA would not detect the issue and would treat the shared memory as secure, reflecting a mislabeling...

CVE-2016-10347

CVE-2016-10347 affects Qualcomm components in Android CAF builds using the Linux kernel; the issue is that an argument to a hypervisor function is not properly validated, enabling potential remote exploitation. The vulnerability is serious (CVSS v3 base score 9.8, CRITICAL) with network access an...