CVE-2019-9252

CVE-2019-9252 affects Android 10, where the libavc component suffers an out-of-bounds read caused by uninitialized data. This leads to remote information disclosure without additional execution privileges; exploitation requires user interaction. Multiple sources (NVD, Red Hat, CVE lists) consiste...

CVE-2019-9280

CVE-2019-9280 affects Android 10 (Framework). The issue is an elevation-of-privilege in the keyguard caused by improper permission checks, enabling a local bypass of the keyguard under limited circumstances. Exploitation requires user execution privileges, but no user interaction is required. Aff...

CVE-2019-9302

CVE-2019-9302 affects Android 10 via the libAACdec library, where an integer overflow can cause an out-of-bounds write leading to remote code execution. The vulnerability requires user interaction to exploit, with impact described as remote code execution and high severity in the CVSS data. Remed...

CVE-2019-9334

CVE-2019-9334 concerns the Android 10 ecosystem where a vulnerability in the Media/Library stack (libhevc) allows information disclosure via uninitialized data. The issue affects Android 10 and is described as enabling remote information disclosure with no additional execution privileges; exploit...

CVE-2019-9364

CVE-2019-9364 affects Android 10 via AudioService. The issue is a permissions bypass that can trigger background user audio, leading to local information disclosure without additional privileges. Exploitation details are not provided beyond the described local disclosure; no explicit on-device ex...

CVE-2019-9427

This entry covers CVE-2019-9427 affecting Android 10 with a Bluetooth use‑after‑free leading to local information disclosure without user interaction. Affected component: Bluetooth stack; root cause: use‑after‑free in Bluetooth handling. Impact: partial confidentiality loss (per CVSS v2) and high...

CVE-2019-9475

CVE-2019-9475 corresponds to a local information disclosure in Android 10 via a permissions bypass in /proc/net of the kernel filesystem. The root cause is a privileged bypass that allows reading information without execution privileges, with exploitation requiring local access and no user intera...

CVE-2020-0134

The CVE-2020-0134 entry concerns Android 10 where in BnDrm::onTransact of IDrm.cpp there is information disclosure due to uninitialized data. This can lead to local information disclosure without extra privileges and without user interaction. Public references include NVD and Red Hat advisories, ...

CVE-2020-0137

CVE-2020-0137 is an Elevation of Privilege vulnerability in Android 10 where the code path setIPv6AddrGenMode in NetworkManagementService.java bypasses a required networking permission due to a missing permission check. This could allow a locally authenticated attacker to gain privileges with no ...

CVE-2020-0141

CVE-2020-0141 is an Android 10 vulnerability described as a race-condition in OutputBuffersArray::realloc within CCodecBuffers.cpp that can cause a heap disclosure, enabling potential information exposure with System privileges. The vulnerability is associated with remote information disclosure a...

CVE-2020-0172

CVE-2020-0172 affects Android 10, where in Parse_art of eas_mdls.c a bounds check is missing, leading to potential resource exhaustion and remote denial of service. The issue requires user interaction for exploitation and is categorized as DoS with a network attack vector (per CVSS data: CVSS v3....

CVE-2020-0174

CVE-2020-0174 affects Android 10, with the Media Framework vulnerability in Parse_ptbl of eas_mdls.c causing resource exhaustion and potential remote denial of service. Exploitation requires user interaction; no explicit exploit details or patch versions are provided in the connected documents. A...

CVE-2020-0176

The CVE-2020-0176 issue is described across multiple sources as an out-of-bounds read in avdt_msg_prs_rej of avdt_msg.cc, enabling remote information disclosure on Android 10 with network access and no user interaction. The vulnerability arises from improper input validation and affects Android-1...

CVE-2020-0194

CVE-2020-0194 is an Android 10 vulnerability in the Media Framework (ihevcd_parse_slice_header.c) where an integer overflow can cause an out-of-bounds write, enabling remote code execution and requiring user interaction to exploit. Public references from NVD/Red Hat/CNVD corroborate the descripti...

CVE-2020-0280

CVE-2020-0280 affects Android 11 and is caused by an out-of-bounds read in nci_proc_ee_management_rsp of nci_hrcv.cc due to a missing bounds check. This can lead to local information disclosure with no additional execution privileges; exploitation requires user interaction. The documentation does...

CVE-2020-0281

CVE-2020-0281 describes an NFC-related out-of-bounds read in Android 11 that could enable remote information disclosure due to a missing bounds check. The issue affects NFC handling and is listed with a root cause of insufficient bounds checking, leading to a potential information leak. Reported ...

CVE-2020-0284

CVE-2020-0284 affects Android 11 Telephony where a missing permission check enables a local permission bypass that can lead to information disclosure without extra execution privileges. Exploitation details are not provided in the supplied documents. The issue is listed across multiple feeds (e.g...

CVE-2020-0311

In CVE-2020-0311, the issue concerns Android 11's InputManagerService where an unsafe PendingIntent enables a permission bypass, causing local information disclosure. Exploitation is possible with LOCAL access and does not require user interaction, but certain user/EOS privileges are indicated as...

CVE-2020-0320

CVE-2020-0320 affects the Android library libstagefright and is described as a resource exhaustion vulnerability caused by improper input validation. This can lead to remote denial of service with no additional execution privileges required, with exploitation requiring user interaction. The issue...

CVE-2020-0372

CVE-2020-0372 affects Android 11. In ActivityManager, a missing permission check enables local information disclosure of protected data without extra execution privileges. Impact is confined to information disclosure (confidentiality), with no user interaction required. The issue is addressed in ...

CVE-2020-0374

CVE-2020-0374 concerns Android 11/NFC where an unsafe PendingIntent can bypass a permission, enabling local elevation of privilege with user rights granted to the attacker. Affected component is the NFC handling path; attack requires local access and does not require user interaction according to...

CVE-2020-0484

CVE-2020-0484 describes a memory corruption vulnerability caused by a use-after-free in the Android component’s ComposerClient.h destroyResources. The issue could allow local elevation of privilege , requiring no user interaction for exploitation and potentially enabling execution with system-lev...

CVE-2020-0491

CVE-2020-0491 affects Android 11 on Pixel devices. The issue is in readBlock of MatroskaExtractor.cpp, where resource exhaustion can cause a denial of service. This can enable remote DoS with user interaction required for exploitation. Exploitation details, affected build patches, and concrete re...

CVE-2020-0498

CVE-2020-0498 affects Android 11 and is associated with a heap buffer overflow in decode_packed_entry_number inside codebook.c, causing an out-of-bounds read that can disclose information remotely with no memory integrity impact and requires user interaction to exploit. Public records consistentl...

CVE-2020-10840

Summary: CVE-2020-10840 describes a kernel pointer leak in the vipx driver affecting Samsung mobile devices with Exynos 9610 (P9.0 and Q10.0). The Samsung internal ID is SVE-2019-16293 (February 2020). The Red Hat entry reiterates the same description. What is affected: Samsung mobile devices wit...

CVE-2020-10841

CVE-2020-10841 affects Samsung mobile devices with P(9.0)/Q(10.0) on Exynos 9610; root cause is an arbitrary kfree in the vipx and vertex drivers. Red Hat/NVD entries corroborate a kernel-free issue with potential high impact (CVE notes partial/confidentiality/availability risks, CVSSv3.1 base 7....

CVE-2020-10843

Affected products: Samsung mobile devices running O(8.x), P(9.0), and Q(10.0) on S.LSI chipsets. Issue: race conditions in the hdcp2 driver. Root cause details are limited to the presence of race conditions in the hdcp2 driver as described in multiple sources. Samsung internal ID: SVE-2019-16296 ...

CVE-2020-10846

CVE-2020-10846 affects Samsung mobile devices with P(9.x) and Q(10.x) software. The issue enables OEM unlock on KG-enrolled devices, potentially allowing download of unwanted binaries. Samsung ID: SVE-2019-16554. No explicit remediation or exploitation details are provided in the connected docume...

CVE-2020-11601

CVE-2020-11601 affects Samsung mobile devices running P (9.0) and Q (10.0). The issue enables unauthorized access to applications in the Secure Folder via floating icons. Connected sources corroborate the Secure Folder access problem (Samsung ID SVE-2019-16195). No concrete root cause, affected c...

CVE-2020-11603

CVE-2020-11603 affects Samsung mobile devices running P(9.0) and Q(10.0) that include TEEGRIS. The issue is a type confusion in the MLDAP Trustlet, leading to arbitrary code execution. The vulnerability is identified by Samsung as SVE-2020-16599 (April 2020). Exploitation details, affected versio...

CVE-2020-15577

Samsung mobile devices running P (9.0) and Q (10.0) software are affected by CVE-2020-15577 via the Cameralyzer component, which can write files to the SD card. Root cause: Cameralyzer ability to write to external storage leads to unauthorized file writes. Impact: potential modification or insert...

CVE-2020-15579

CVE-2020-15579 describes a FRP bypass on Samsung mobile devices running O(8.x), P(9.0) and Q(10.0) via the KNOX API (Samsung ID SVE-2020-17318). Documents consistently identify FRP bypass as the issue; no concrete exploit technique, affected model list, or fixed version is provided in the sources...

CVE-2020-25281

The CVE-2020-25281 entry concerns LG mobile devices running Android 7.x–8.1 where apps with sensitive security settings (e.g., the package verifier) mishandle unknown-source installations. Affected component/function relates to the installation pipeline for unknown sources. Underlying impact stat...

CVE-2020-27029

CVE-2020-27029 affects Android 11 TextView. In TextView.java, improper input validation can cause an app hang, enabling a remote denial of service with no extra privileges. Exploitation requires user interaction. CVSS metrics indicate a base CVSS v3.1 score of 6.5 (Network, Low attack complexity,...

CVE-2020-27039

CVE-2020-27039 : A flaw in Android 11 related to postNotification in ServiceRecord.java enables a local permission bypass via an unsafe PendingIntent. This could lead to local information disclosure with low to medium risk (CVSSv3.1 base score 5.5; LOCAL, NONE user interaction). Exploitation is d...

CVE-2020-27048

CVE-2020-27048 affects Android 11 and targets the RW_SendRawFrame path in rw_main.cc, where a missing bounds check allows an out-of-bounds write. This can lead to local escalation of privilege with no extra execution privileges required, and exploitation requires user interaction. The issue is li...

CVE-2020-27057

CVE-2020-27057 affects Android 11 and is described as a permission bypass in GpuService.cpp: getGpuStatsGlobalInfo and getGpuStatsAppInfo, where a missing permission check could allow local disclosure of GPU statistics with user privileges and without user interaction. Exploitation details are no...

CVE-2021-0369

CVE-2021-0369 is linked to CrossProfileAppsServiceImpl.java in Android 11, where a logic error can cause an application’s INTERACT_ACROSS_PROFILES grant state to be displayed incorrectly in Settings UI, enabling local privilege escalation. The exploitation requires user interaction, and the issue...

CVE-2021-0422

CVE-2021-0422 concerns the memory management driver in MediaTek-based systems. The issue is a missing bounds check that can cause a system crash, enabling local denial of service without requiring user interaction. Multiple documents confirm the root cause and the potential impact (local DoS, hig...

CVE-2021-0425

CVE-2021-0425 relates to a side-channel information disclosure in the memory management driver, enabling local information disclosure without user interaction. The vulnerability affects the memory-management component and is tied to the Mediatek ecosystem per linked advisories. The root cause is ...

CVE-2021-0634

CVE-2021-0634 affects MediaTek’s display driver; vulnerability arises from memory corruption due to uninitialized data, enabling local privilege escalation to SYSTEM with no user interaction. Connected sources (Red Hat, NVD, CVE records) confirm the issue and reference patch ALPS05594994 (Issue A...

CVE-2021-0659

The CVE-2021-0659 entry concerns the apusys component where an out-of-bounds read can occur due to an incorrect bounds check. This may lead to local information disclosure and requires system privileges for impact; exploitation does not require user interaction. Affected context is supported by c...

CVE-2021-0901

The CVE-2021-0901 issue affects MediaTek Apusys (chipset component). It describes a memory corruption vulnerability caused by a missing bounds check in apusys, enabling local privilege escalation with System execution privileges required and no user interaction needed. Affected state and impact a...

CVE-2021-0902

CVE-2021-0902 affects MediaTek Apusys. The issue is an out-of-bounds read caused by an incorrect bounds check in apusys, potentially leading to local information disclosure with SYSTEM privileges required for exploitation and no user interaction. Public details in the initial and connected record...

CVE-2021-25491

CVE-2021-25491 affects the Samsung mfc driver. The root cause is a NULL-pointer dereference that can cause memory corruption in versions prior to Samsung SMR Oct-2021 Release 1. Public data indicates impact on memory handling, with CVSS details showing low to medium base severity depending on met...

CVE-2022-39113

The CVE-2022-39113 entry involves a missing permission check in the Music service that could allow local denial of service without extra privileges. Connected documents corroborate a local impact but do not provide concrete product/version details for the Music service itself. Some sources refere...

CVE-2022-48448

CVE-2022-48448 affects the telephony service and is associated with a missing permission check that could allow a local denial of service without elevating privileges. Across the provided sources (NVD, RH, CVE list, PRION, CNNVD, etc.), the core described impact is local DoS with no additional ex...

CVE-2022-48452

CVE-2022-48452 affects Ifaa service used in UNISOC chipsets. The root cause is a missing permission check, enabling local denial of service with SYSTEM privileges required. Exploitation is described as local (no UI interaction). The CVE entry shows a MEDIUM severity (CVSS v3.1: 4.4) with PRIVILEG...

CVE-2022-48460

CVE-2022-48460 affects the UNISOC setting service. The root cause is undefined behavior from incorrect error handling, leading to local denial of service without additional privileges. Public details across connected documents confirm the issue’s nature but do not specify exact affected products/...

CVE-2023-20625

CVE-2023-20625 affects the adsp component and is caused by a race condition leading to a double free. This can allow local privilege escalation with SYSTEM-level execution privileges, and exploitation does not require user interaction. The entry lists patch ALPS07628532 (Issue ID ALPS07628532) as...