CVE-2020-0192

CVE-2020-0192 affects Android 10 in the Media Framework. The issue is an out-of-bounds read in ih264d_decode_slice_thread (ih264d_thread_parse_decode.c) caused by improper input validation, enabling remote information disclosure with user interaction required for exploitation. Public references i...

CVE-2020-0197

CVE-2020-0197 affects Android 10, caused by an out-of-bounds read in InitDataParser::parsePssh, enabling local information disclosure without user interaction. Official sources (NVD/Red Hat/NCSC and Pixel bulletin) confirm this Android Media Framework issue and list Android-10 as affected. The vu...

CVE-2020-0274

The CVE-2020-0274 issue affects the Android 11 OMX parser, where a returned raw pointer can cause local information disclosure without requiring user interaction. This is described across multiple sources (NVD/Red Hat/CNVD entries) as an information-disclosure vulnerability tied to the OMX parser...

CVE-2020-0300

CVE-2020-0300 affects Android 11 NFC handling, where an out-of-bounds read from uninitialized data can lead to remote information disclosure without user interaction. The NVD CVSSv3.1 base score is 7.5 (High) with network attack vector and no privileges required; CVSSv2 base score 5.0 (Medium). A...

CVE-2020-0326

CVE-2020-0326 affects Android 11 via an NFC-related out-of-bounds write caused by uninitialized data, enabling local privilege escalation with System-level privileges and no user interaction required. Multiple connected sources confirm the issue in Android 11’s NFC handling; remediation is addres...

CVE-2020-0340

CVE-2020-0340 affects Android 11 via the libcodec2_soft_mp3dec component, where uninitialized data can cause information disclosure. The issue allows remote information disclosure with no execution privileges and requires user interaction to exploit. The provided connected documents confirm the v...

CVE-2020-0359

CVE-2020-0359 affects the Android GLESRenderEngine on Android 11, where an out-of-bounds read caused by a buffer overflow could enable local information disclosure without user interaction. The issue is described as a local vulnerability with no execution privileges required and no interaction ne...

CVE-2020-0364

CVE-2020-0364 affects Android 11 via libDRCdec, where a missing bounds check causes an out-of-bounds read that can disclose information remotely. Exploitation requires user interaction. The issue is documented as fixed in the Android 11 security release notes; update to Android 11 with the patch ...

CVE-2020-0491

CVE-2020-0491 affects Android 11 on Pixel devices. The issue is in readBlock of MatroskaExtractor.cpp, where resource exhaustion can cause a denial of service. This can enable remote DoS with user interaction required for exploitation. Exploitation details, affected build patches, and concrete re...

CVE-2020-10841

CVE-2020-10841 affects Samsung mobile devices with P(9.0)/Q(10.0) on Exynos 9610; root cause is an arbitrary kfree in the vipx and vertex drivers. Red Hat/NVD entries corroborate a kernel-free issue with potential high impact (CVE notes partial/confidentiality/availability risks, CVSSv3.1 base 7....

CVE-2020-27026

CVE-2020-27026 affects Android 11 devices (as described: Android-11) where the lock screen/unlock interface during boot behaves differently depending on whether a fingerprint is registered. This can lead to local information disclosure without additional execution privileges. The vulnerability is...

CVE-2020-27030

CVE-2020-27030 (Android 11) describes a permission bypass caused by a flaw in HandleApiCalls.java during onCreate, enabling local escalation of privilege via a confused deputy. This could let an app set or dismiss alarms without additional privileges, with no user interaction required. Exploitati...

CVE-2020-27053

CVE-2020-27053 affects Android 11. In ClientModeImpl.java, broadcastWifiCredentialChanged has a missing permission check causing a location permission bypass. This could lead to local disclosure of the WiFi network name with System execution privileges; no user interaction is required for exploit...

CVE-2020-27056

CVE-2020-27056 affects Android 11 with a missing permission check in SELinux MLS policies that can disclose local package-metadata information without extra privileges. The issue is confirmed as a local information-disclosure vulnerability; no exploitation details are provided in the documents. R...

CVE-2021-0409

CVE-2021-0409 affects the MediaTek flv extractor, where an out-of-bounds read can occur due to an incorrect bounds check. This may lead to local information disclosure without requiring user interaction. The issue is documented with patch ID ALPS05561359 / Issue ID ALPS05561359. Connected sources...

CVE-2021-0424

The CVE-2021-0424 entry concerns a Mediatek device where the in memory management driver has a missing bounds check, enabling a local denial-of-service due to a system crash. Exploitation requires local access with no user interaction. The patch reference is ALPS05403499 (Issue ALPS05393787). Con...

CVE-2021-0425

CVE-2021-0425 relates to a side-channel information disclosure in the memory management driver, enabling local information disclosure without user interaction. The vulnerability affects the memory-management component and is tied to the Mediatek ecosystem per linked advisories. The root cause is ...

CVE-2021-0612

CVE-2021-0612 describes a memory corruption in the m4u component, caused by a use-after-free, enabling local escalation of privilege with system execution privileges required. Exploitation reportedly does not require user interaction. Affected context is Mediatek-based hardware; patch ALPS0540349...

CVE-2021-0618

CVE-2021-0618 affects MediaTek’s ape extractor. The vulnerability is a heap buffer overflow that can enable a local out-of-bounds read leading to information disclosure, with no user interaction required. Patch ID ALPS05561394 addresses the issue. Exploitation details are not provided in the acce...

CVE-2021-0901

The CVE-2021-0901 issue affects MediaTek Apusys (chipset component). It describes a memory corruption vulnerability caused by a missing bounds check in apusys, enabling local privilege escalation with System execution privileges required and no user interaction needed. Affected state and impact a...

CVE-2021-25383

The CVE-2021-25383 entry concerns the Samsung libsapeextractor library. Affected component: scmn_mfal_read() in libsapeextractor. Root cause: improper input validation prior to SMR MAY-2021 Release 1. Impact: allows an attacker to execute arbitrary code on the mediaextractor process. Public detai...

CVE-2021-25384

CVE-2021-25384 describes an improper input validation in the Samsung libsdffextractor library, specifically in the function handling the Sample Rate Chunk (sdfffd_parse_chunk_PROP). The vulnerability, affecting versions prior to SMR MAY-2021 Release 1, can allow an attacker to trigger arbitrary c...

CVE-2021-25413

CVE-2021-25413 affects Samsung Contacts prior to SMR June-2021 Release 1. The root cause is improper sanitization of incoming intents, enabling a local attacker to access arbitrary data within the Samsung Contacts privilege. Impact is partial confidentiality exposure of data via a local vector. T...

CVE-2021-25484

The CVE-2021-25484 entry concerns an improper authentication flaw in InputManagerService. Affected component: InputManagerService (Samsung SMR prior to Oct-2021 Release 1). Impact stated: it allows monitoring the touch event. Documented references indicate a Samsung security update (securityUpdat...

CVE-2022-47491

CVE-2022-47491 concerns the UNISOC-soter service, where a missing bounds check enables an out-of-bounds write. This could yield local denial of service with execution privileges required. The NVD notes a CVSS v3.1 base score of 4.4 (MEDIUM); attack vector LOCAL, privilege requirement HIGH, and av...

CVE-2022-48389

CVE-2022-48389 affects the modem control device in Unisoc chipsets. Root cause: a missing bounds check enables an out-of-bounds write. Impact: local denial of service with SYSTEM privileges (high-impact write, per CVSS 3.1 vector). Exploitation details are not provided in the connected documents;...

CVE-2022-48439

The CVE-2022-48439 entry concerns the cp_dump driver, where a missing bounds check enables an out-of-bounds write. This can lead to a local denial of service with SYSTEM-level execution privileges required. Public sources confirm the impact includes availability risk, with confidentiality/integri...

CVE-2023-20824

CVE-2023-20824 affects duraspeed components (MediaTek context) and is caused by a missing permission check, enabling local information disclosure without extra privileges or user interaction. The vulnerability is described across multiple sources (including Red Hat and NVD records) and is associa...

CVE-2023-20851

CVE-2023-20851 affects stc with a race-condition leading to an out-of-bounds read and local escalation of privilege. Impact requires System execution privileges and user interaction for exploitation, per multiple feeds. A patch is available (Patch ID ALPS08048635; Issue ID ALPS08048635). Exploita...

CVE-2023-21323

CVE-2023-21323 is an information-disclosure vulnerability in Android's Activity Manager that could let a local attacker determine whether an app is installed without query permissions. The issue stems from a side-channel disclosure, requiring no user interaction and no additional execution privil...

CVE-2023-21345

CVE-2023-21345 is described as an information-disclosure issue in Android’s Game Manager Service where an attacker can determine if an app is installed without query permissions via a side-channel. The available documents indicate local exploitation with no user interaction and a low overall risk...

CVE-2023-30865

CVE-2023-30865 affects the dialer service where a missing permission check can allow local information disclosure without extra privileges. The common description across sources states the root cause is inadequate permission verification, enabling disclosure with low attack complexity and local a...

CVE-2023-30915

CVE-2023-30915 : The issue is a missing permission check in the email service , enabling possible local information disclosure without extra execution privileges. The NVD entry lists a CVSS v3.1 base score of 5.5 (MEDIUM), with LOCAL attack vector, LOW attack complexity and LOW privileges require...

CVE-2023-30916

CVE-2023-30916 concerns a missing permission check in DMService that could enable local privilege escalation with no extra privileges required. Public sources reference DMService across several Unisoc (UNISOC) chipsets, including SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T612, T616...

CVE-2023-30922

CVE-2023-30922 describes a missing permission check in the messaging service, leading to local information disclosure without extra execution privileges. The vulnerability is reported across multiple sources tied to UNISOC chipsets (e.g., SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T...

CVE-2023-30940

CVE-2023-30940 : A missing permission check in the telephony service allows local information disclosure without additional privileges. Documented impact is data exposure (confidentiality impact) with a local attack surface. Affected platforms include Unisoc-based devices (e.g., certain SC famili...

CVE-2023-30942

CVE-2023-30942 is described across multiple connected feeds as a vulnerability in a telephony service where a missing permission check can lead to local information disclosure without requiring extra execution privileges. Reported impact is local disclosure (confidentiality) with no exploitation ...

CVE-2023-33882

CVE-2023-33882 involves a missing permission check in the telephony service that could cause local information disclosure without additional privileges. Connected sources consistently describe a local-impact vulnerability with HIGH confidentiality impact and a CVSS‑3.1 base score of 5.5 (LOCAL, L...

CVE-2023-33897

CVE-2023-33897 affects libimpl-ril and is caused by a missing bounds check that leads to an out-of-bounds write. This can result in local denial of service with SYSTEM privileges required. The available documents confirm the vulnerability and its impact but do not provide specifics on affected pr...

CVE-2023-38449

CVE-2023-38449 affects vowifiservice and is caused by a missing permission check, enabling local privilege escalation with no additional execution privileges (per the CVE description and connected records). The NVD entry shows a CVSS v3.1 base score of 7.8 (HIGH) with local attack vector, low att...

CVE-2023-38553

CVE-2023-38553 affects the gnss service on Unisoc chipsets, where a missing bounds check can trigger an out-of-bounds write. This could allow local escalation of privilege with System execution privileges needed (local, high privileges, no user interaction). The provided documents do not specify ...

CVE-2023-38554

CVE-2023-38554 concerns the wcn bsp driver with an out-of-bounds write caused by a missing bounds check, potentially enabling local denial of service with no extra privileges. Affected component: wcn bsp driver (UnISOC context). Impact: local DoS (availability impact) as stated; no explicit explo...

CVE-2023-42638

The CVE concerns the validationtools component and a missing permission check that could allow local information disclosure without additional execution privileges. The NVD entry assigns CVSS v3.1 base score 5.5 (Medium) with local attack vector and high confidentiality impact. Connected advisori...

CVE-2023-42672

The CVE-2023-42672 entry concerns UNISOC/imsservice with a missing permission check, enabling an attacker to write permission usage records and cause local information disclosure without executing code. Affected component: imsservice in UNISOC chipsets. Root cause: absence of permission validatio...

CVE-2023-42682

CVE-2023-42682 affects the gsp driver and stems from a missing bounds check, allowing an out-of-bounds write that could cause local denial of service with system-level privileges required. The provided documents specify the impact (local DoS) and privilege requirements but do not include exploit ...

CVE-2023-42684

CVE-2023-42684 concerns the gsp driver within UNISOC chipsets, where a missing bounds check can cause an out-of-bounds read. The issue is described as leading to local denial of service with System execution privileges required. Documents consistently cite the gsp driver as the vulnerable compone...

CVE-2023-42726

CVE-2023-42726 affects TeleService components (UNISOC/chipset context) with an out-of-bounds read caused by a missing bounds check. The consequence stated across sources is a local denial-of-service scenario, potentially tied to the ability to execute with system privileges. No concrete product v...

CVE-2025-36893

CVE-2025-36893 describes a local information-disclosure vulnerability due to uninitialized data in ReadTachyonCommands within gxp_main_actor.cc. The issue can leak information with no additional execution privileges and no user interaction required. Affected component: the gxp main actor’s ReadTa...

CVE-2025-48562

CVE-2025-48562 is an Android information-disclosure flaw caused by a logic error in the writeContent function of RemotePrintDocument.java. The issue can lead to local information disclosure without additional execution privileges, and exploitation requires user interaction. Multiple connected sou...

CVE-2025-48573

The CVE-2025-48573 entry describes a local elevation-of-privilege in Android's MediaSessionRecord.java via a path in sendCommand that could allow launching a foreground service while the app is backgrounded (FGS while-in-use abuse). The issue enables privilege escalation without extra execution p...