CVE-2020-0370

CVE-2020-0370 affects the Android 11 platform, with a vulnerability in the libAACdec component where a missing bounds check can cause an out-of-bounds read. This may enable remote information disclosure and, per the CVE description, requires user interaction to exploit. Affected software is Andro...

CVE-2020-0481

This CVE (CVE-2020-0481) concerns Android where in AndroidManifest.xml a permissions bypass enables local elevation of privilege. The impact is that a non-system app could broadcast without having required permissions, with no user interaction. Affected info from the sources specifies Android 11 ...

CVE-2020-25047

CVE-2020-25047 affects Samsung mobile devices on Android P/Q where the S Secure app does not enforce the intended password requirement for a locked application. Root cause: insufficient password enforcement in S Secure. Impact is partial confidentiality and potential access to a locked app; CVE s...

CVE-2020-27025

CVE-2020-27025 affects Android 11 and is caused by an unsafe PendingIntent in EapFailureNotifier.java and SimRequiredNotifier.java, enabling a permission bypass that can lead to local information disclosure. The issue requires no user interaction and could be triggered with local access; the root...

CVE-2020-27050

CVE-2020-27050 affects Android 11 with an issue in rw_i93_send_cmd_write_multi_blocks (rw_i93.cc). The root cause is a heap buffer overflow causing an out-of-bounds write, which the description states could lead to local privilege escalation with no additional execution privileges required. User ...

CVE-2021-0423

CVE-2021-0423 concerns an information disclosure in the Mediatek memory management driver due to uninitialized data. This can enable local information disclosure with no additional execution privileges and without user interaction. The vulnerability is documented across multiple sources including...

CVE-2021-25383

The CVE-2021-25383 entry concerns the Samsung libsapeextractor library. Affected component: scmn_mfal_read() in libsapeextractor. Root cause: improper input validation prior to SMR MAY-2021 Release 1. Impact: allows an attacker to execute arbitrary code on the mediaextractor process. Public detai...

CVE-2021-25484

The CVE-2021-25484 entry concerns an improper authentication flaw in InputManagerService. Affected component: InputManagerService (Samsung SMR prior to Oct-2021 Release 1). Impact stated: it allows monitoring the touch event. Documented references indicate a Samsung security update (securityUpdat...

CVE-2022-48385

CVE-2022-48385 affects the UNISOC chipsets cp_dump driver. The vulnerability is an out-of-bounds write caused by a missing bounds check, leading to local denial of service with System execution privileges required. The CVSS/metrics indicate LOCAL access, HIGH privileges, no user interaction, and ...

CVE-2022-48389

CVE-2022-48389 affects the modem control device in Unisoc chipsets. Root cause: a missing bounds check enables an out-of-bounds write. Impact: local denial of service with SYSTEM privileges (high-impact write, per CVSS 3.1 vector). Exploitation details are not provided in the connected documents;...

CVE-2022-48439

The CVE-2022-48439 entry concerns the cp_dump driver, where a missing bounds check enables an out-of-bounds write. This can lead to a local denial of service with SYSTEM-level execution privileges required. Public sources confirm the impact includes availability risk, with confidentiality/integri...

CVE-2023-20824

CVE-2023-20824 affects duraspeed components (MediaTek context) and is caused by a missing permission check, enabling local information disclosure without extra privileges or user interaction. The vulnerability is described across multiple sources (including Red Hat and NVD records) and is associa...

CVE-2023-30942

CVE-2023-30942 is described across multiple connected feeds as a vulnerability in a telephony service where a missing permission check can lead to local information disclosure without requiring extra execution privileges. Reported impact is local disclosure (confidentiality) with no exploitation ...

CVE-2023-32789

CVE-2023-32789 concerns a missing permission check in the telephony service that enables local information disclosure without additional execution privileges. The core issue is a privilege check gap in the telephony component, with CVSS 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicating local acc...

CVE-2023-32856

CVE-2023-32856 concerns MediaTek chipsets where the display module has an out-of-bounds read caused by an incorrect status check. The vulnerability can lead to local information disclosure with System execution privileges required, and exploitation does not require user interaction. The available...

CVE-2023-32860

Affected product: MediaTek chips (display module). Vulnerability: classic buffer overflow due to a missing bounds check in display handling. Root cause: out-of-bounds write leading to local privilege escalation with SYSTEM-level privileges required. Exploit: no user interaction required (local ex...

CVE-2023-33882

CVE-2023-33882 involves a missing permission check in the telephony service that could cause local information disclosure without additional privileges. Connected sources consistently describe a local-impact vulnerability with HIGH confidentiality impact and a CVSS‑3.1 base score of 5.5 (LOCAL, L...

CVE-2023-33886

CVE-2023-33886 affects the telephony service where a missing permission check can cause local information disclosure without additional execution privileges. The CVE's base metrics show Local attack vector, Low attack complexity, Low privileges required, no user interaction, and Confidentiality i...

CVE-2023-33901

CVE-2023-33901 affects UNISOC Bluetooth service due to a missing permission check, enabling local information disclosure without extra privileges. Public details in connected sources enumerate affected UNISOC chipsets, including SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T612, T616,...

CVE-2023-33904

CVE-2023-33904 affects the hci_server component. The root cause is a missing bounds check that enables an out-of-bounds read, which can lead to local denial of service with system execution privileges required. Multiple databases corroborate this vulnerability and cite the same description. Affec...

CVE-2023-33913

CVE-2023-33913 describes a vulnerability in the DRM/oemcrypto module where an incorrect calculation of the buffer size allows an out-of-bounds write. This could lead to remote escalation of privilege with system execution privileges required. The initial documents confirm the issue and its impact...

CVE-2023-38436

The CVE-2023-38436 entry concerns vowifiservice and describes a missing permission check that could allow local information disclosure without requiring additional privileges. Across connected sources, the impact is stated as information disclosure with a local attack vector and no explicit remot...

CVE-2023-38458

In the provided documents, CVE-2023-38458 affects vowifiservice (Unisoc/UNISOC chipsets) with a possible missing permission check that could enable local escalation of privilege. The NVD entry describes the impact as local escalation with no extra execution privileges, and the attack vector is LO...

CVE-2023-38459

CVE-2023-38459 affects vowifiservice. The connected documents confirm a missing permission check in vowifiservice as the root cause, enabling local privilege escalation with low privileges and no user interaction. Impact is described as local escalation of privilege; no explicit exploitation deta...

CVE-2023-38464

CVE-2023-38464 affects the vowifiservice component (in UNISOC chipsets). The security issue is a missing permission check that could allow local escalation of privilege without requiring additional execution privileges. The CVSS 3.1 vector from NVD indicates a Local, Low Complexity exploit with L...

CVE-2023-42638

The CVE concerns the validationtools component and a missing permission check that could allow local information disclosure without additional execution privileges. The NVD entry assigns CVSS v3.1 base score 5.5 (Medium) with local attack vector and high confidentiality impact. Connected advisori...

CVE-2023-42699

CVE-2023-42699 concerns the omacp service. A missing permission check could allow writing permission usage records for an app, enabling local information disclosure without additional execution privileges. Public sources summarize the issue and impact (local information disclosure) but do not pro...

CVE-2023-42709

CVE-2023-42709 affects UNISOC/chipset Firewall service where a missing permission check enables writing of an app’s permission usage records, leading to local information disclosure without extra privileges. Exploitation details are not provided in the connected documents; no concrete exploit vec...

CVE-2023-42714

CVE-2023-42714 affects the firewall service and is discussed across multiple sources (NVD, Red Hat, CVE List, CNNVD). The root issue is a missing permission check that enables writing permission usage records for an app, leading to potential local information disclosure with no extra execution pr...

CVE-2023-42726

CVE-2023-42726 affects TeleService components (UNISOC/chipset context) with an out-of-bounds read caused by a missing bounds check. The consequence stated across sources is a local denial-of-service scenario, potentially tied to the ability to execute with system privileges. No concrete product v...

CVE-2023-42727

The CVE-2023-42727 entry concerns an out-of-bounds write in a GPU driver caused by an incorrect bounds check, leading to local denial of service with SYSTEM privileges required. Multiple connected records corroborate that the affected component is the GPU driver and describe the same root cause a...

CVE-2023-42735

CVE-2023-42735 affects the telephony service (noted by NVD/Red Hat/PRION/CVE list). The vulnerability arises from a missing permission check in the telephony service, enabling local information disclosure with System execution privileges needed. CVSS v3.1 indicates a Local attack, Low attack comp...

CVE-2023-42740

CVE-2023-42740 - A missing permission check in the telecom service allows writing permission usage records, enabling local escalation of privilege without extra execution privileges. The issue is documented across multiple sources (NVD, Red Hat, PRION, CNNVD, etc.) and is associated with UNISOC t...

CVE-2023-48347

CVE-2023-48347 affects a video decoder component in Unisoc chipsets. The root cause is improper input validation that enables an out-of-bounds read, leading to a local denial of service with no additional privileges required. Reports consistently describe the impact as local DoS; no exploit detai...

CVE-2023-48356

CVE-2023-48356 concerns the jpg driver in UNISOC chipsets. The root cause is a missing bounds check leading to an out-of-bounds write. This can cause local denial of service with system execution privileges required. The available sources (NVD/Red Hat/linked records) describe the vulnerability an...

CVE-2025-48565

The CVE-2025-48565 entry describes a logic error in Android’s cross-profile intent filtering, enabling local escalation of privilege without extra execution privileges or user interaction. Affected component is the Framework/IntentResolver logic in multiple Android locations, with exploitation de...

CVE-2025-48652

The CVE-2025-48652 entry describes a logic error in performPreInstallChecks within InstallRepository.kt that could bypass MDM policy, enabling local escalation of privilege with no extra execution privileges required and no user interaction needed. Connected sources (EUVD-2025-210017, NVD) corrob...

CVE-2025-48654

CVE-2025-48654 concerns the Android CompanionDeviceManagerService.java, where a logic error in onStart can cause a confused deputy leading to local elevation of privilege. Exploitation does not require user interaction. Affected component: CompanionDeviceManagerService (Android). Reported impact:...

CVE-2026-0019

CVE-2026-0019 affects SettingsLib and enables a logic-error path that could disable system components, enabling local privilege escalation without extra privileges or user interaction. The issue is classified as Elevation of Privilege (High) in Android 17 release notes; patches are included in An...

CVE-2026-0038

CVE-2026-0038 describes a logic error in mem_protect.c across multiple functions that could allow arbitrary code execution, leading to local privilege escalation with no additional privileges and without user interaction. The available sources consistently reference mem_protect.c but do not provi...

CVE-2026-0045

CVE-2026-0045 concerns a logic error in the Bluetooth stack: in bta_jv_rfcomm_connect of bta_jv_act.cc , there is a possible bypass of bonding for a secure connection. This could allow local escalation of privilege with no additional execution privileges needed, and requires no user interaction t...

CVE-2026-0074

CVE-2026-0074 describes a potential denial of service via the getPreferredSize path in LauncherProcessImageListener.kt, where a resource exhaustion condition could be triggered locally. The available documents consistently report a DoS risk requiring local access, with no user interaction needed....

CVE-2026-0088

The CVE-2026-0088 affects Android’s CertInstaller.getCallingAppLabel, where a misleading or insufficient UI could allow hiding a sensitive security dialogue. This enables local privilege escalation with no extra privileges and no user interaction required for exploitation, as described across NVD...

CVE-2026-0138

The CVE-2026-0138 issue affects the function lwis_io_buffer_write in lwis_io_buffer.c, described across multiple sources (NVD, ENISA EUVD, CVE listings, OSV) as a possible out-of-bounds write caused by memory corruption. Impact is local elevation of privilege requiring system execution privileges...

CVE-2026-0150

CVE-2026-0150 affects EdgeTPU firmware, specifically the ExecuteGraph command handler. The issue is a possible out-of-bounds write caused by an integer overflow, enabling local escalation of privilege with root privileges required. Exploitation does not require user interaction. The available con...

CVE-2026-0156

CVE-2026-0156 describes a memory safety issue in checkSsrcCollisionOnRcv of RtpSession.cpp caused by a missing null check. This could allow remote denial of service without additional execution privileges, and exploitation does not require user interaction. The information appears consistently in...

CVE-2014-9958

CVE-2014-9958 is an elevation of privilege in Qualcomm closed‑source components within Android kernel. The vulnerability affects Qualcomm components integrated in Android devices and is listed in the Android security bulletin with fixes provided by Qualcomm AMSS and Android patch updates (June 20...

CVE-2016-10236

CVE-2016-10236 describes an information-disclosure vulnerability in the Qualcomm USB driver affecting Android devices with affected Android kernel components. The NVD entry characterizes the issue as a local information exposure in the Qualcomm USB driver, with Pixel and Pixel XL listed among aff...

CVE-2018-11869

CVE-2018-11869 affects Android-family releases used on CAF/Linux kernels. The issue is a lack of length validation for a value received from firmware, which can cause a buffer overflow in the WMA handler . The vulnerability is described as local with potential complete impact on confidentiality, ...

CVE-2018-11943

CVE-2018-11943 affects CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue arises in processing the fastboot flash command, causing memory leaks or unexpected behavior due to handling of uninitialized data buffers. Public references in NVD/CVE r...