CVE-2018-11956

Technical details about CVE-2018-11956 are not provided in the connected documents. The sources present only the general issue without specifics (affected components, root cause, impact, or fixes). Monitor for updates.

CVE-2018-5835

CVE-2018-5835 describes a potential buffer overflow in the Android WLAN stack: when seq_len exceeds CSR_MAX_RSC_LEN, copying keyRSC in __wlan_hdd_cfg80211_add_key() may overflow. This affects Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The ...

CVE-2018-5889

CVE-2018-5889 affects Qualcomm bootloader components. The connected records classify it as a Local Elevation of Privilege (EoP) vulnerability in the bootloader, with a moderate severity. The issue is described as a buffer overflow occurring in Android releases from CAF when processing a compresse...

CVE-2019-2148

CVE-2019-2148 affects the libxaac library in Android 10, where an out-of-bounds read due to a missing bounds check can lead to information disclosure. The vulnerability requires user interaction to exploit and is described across multiple sources (NVD, Red Hat). Practical impact is information di...

CVE-2019-2158

CVE-2019-2158 affects Android-10 in the libxaac library, with an out-of-bounds read caused by a missing bounds check. This can lead to an information disclosure and requires user interaction to exploit. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, PRION, CVE List) ...

CVE-2019-2168

CVE-2019-2168 affects the libxaac library in Android 10. The issue is information disclosure caused by uninitialized data, requiring user interaction to exploit. The vulnerability manifests as partial confidentiality impact with no integrity/availability impact stated, and a network attack vector...

CVE-2019-9264

CVE-2019-9264 affects Android 10 where the libxaac library contains a missing-bounds-check flaw that enables an information-disclosure via an out-of-bounds read. This issue requires user interaction for exploitation and could disclose partial data without executing code. The root cause is an out-...

CVE-2019-9317

CVE-2019-9317 affects Android 10’s libstagefright, where a missing variable initialization could allow remote information disclosure. Root cause is an uninitialized variable in libstagefright, enabling information leakage without additional privileges; exploitation requires user interaction per t...

CVE-2019-9347

CVE-2019-9347 affects Android 10 via the m4v_h263 codec. The vulnerability is an out-of-bounds read caused by a use-after-free, leading to local information disclosure without requiring user interaction. Documentation across sources confirms the issue in the Media framework; exploitation details ...

CVE-2019-9355

CVE-2019-9355 is an Android Bluetooth information-disclosure vulnerability described as an out-of-bounds read caused by a missing bounds check. It could allow remote information disclosure without user interaction, with network attack potential as per CVSS metrics (CVSS v3.1: 7.5, HIGH; CVSS v2: ...

CVE-2020-0208

CVE-2020-0208 affects Android Framework, specifically in multiple functions of AccountManager.java, where a permissions bypass could enable local privilege escalation with no additional execution privileges needed and without user interaction. The vulnerability is reflected in multiple sources: N...

CVE-2020-0285

CVE-2020-0285 affects Android 11 Telephony. The issue is a missing permission check that enables a local information disclosure without requiring additional execution privileges, and does not require user interaction for exploitation. The vulnerability is described consistently across multiple co...

CVE-2020-0316

CVE-2020-0316 affects Android 11, with a missing permission check in Telephony that could allow local disclosure of radio data without extra privileges or user interaction. The issue targets the Telephony component and is described across multiple sources as an information disclosure vulnerabilit...

CVE-2020-0351

CVE-2020-0351 affects Android 11 via the libstagefright component, where improper input validation can cause CPU exhaustion leading to remote denial of service. Impact is a DoS with no additional execution privileges required; exploitation is noted as requiring user interaction, but explicit expl...

CVE-2020-0492

CVE-2020-0492 affects Android 11 Media framework (BitstreamFillCache in bitstream.cpp). Root cause: out-of-bounds read caused by a heap buffer overflow leading to potential remote information disclosure. Impact: requires no privileges but may require user interaction for exploitation; exposed dat...

CVE-2020-0493

CVE-2020-0493 is an Android Pixel vulnerability tied to CPDF_SampledFunc::v_Call, where an out-of-bounds read due to input validation issues could disclose local information without user interaction. The issue is listed in the Pixel update bulletin for December 2020 as CVE-2020-0493 (Android bug ...

CVE-2020-0494

CVE-2020-0494 corresponds to a heap buffer overflow in ih264d_parse_ave (ih264d_sei.c) that can cause an out-of-bounds read and remote information disclosure on Android 11 devices. The vulnerability affects Android 11 Pixel/Android components in the media stack and is described as requiring user ...

CVE-2020-27054

CVE-2020-27054 affects Android 11, where onFactoryReset in BluetoothManagerService.java lacks a permission check, enabling local escalation of privilege with no additional execution privileges and no user interaction required. The NVD entry lists CVSS v3.1 base score 7.8 (HIGH) and local attack, ...

CVE-2021-0421

The CVE-2021-0421 entry concerns Mediatek’s memory management driver, where a missing bounds check can cause local information disclosure without extra execution privileges. Exploitation reportedly does not require user interaction, and the impact is described as disclosure of local information (...

CVE-2022-47340

The CVE-2022-47340 entry describes a vulnerability in UNISOC h265 codec firmware where a missing bounds check allows an out-of-bounds write, causing local denial of service. Affected component: UNISOC h265 codec firmware in UNISOC chipsets; root cause: lack of boundary checking leading to out-of-...

CVE-2022-47352

The CVE-2022-47352 entry concerns the camera driver in Unisoc chipsets, where a missing bounds check allows an out-of-bounds read. This is described across Red Hat/NVD/CVE records as enabling possible local denial of service with SYSTEM-level execution required. Affected component is the camera d...

CVE-2022-48381

CVE-2022-48381 affects the modem control device with an out-of-bounds write caused by a missing bounds check. The impact described in the sources is local denial of service with System execution privileges required, without mention of remote access. Documents consistently cite the same generic vu...

CVE-2022-48462

CVE-2022-48462 : In the wifi service, there is a possible out-of-bounds write caused by a missing bounds check, which could lead to local denial of service with no additional execution privileges required. The issue is documented across NVD/Red Hat/CVE lists and related feeds; the available sourc...

CVE-2023-20748

CVE-2023-20748 affects Mediatek-related chips with a vulnerability in the display path causing an out-of-bounds read due to a missing bounds check. Impact cited as local information disclosure with system-level privileges needed; exploitation reportedly does not require user interaction. Patch ID...

CVE-2023-20767

CVE-2023-20767 affects the pqframework. The root cause is a missing bounds check that enables an out-of-bounds write, potentially allowing local privilege escalation with System execution privileges. Exploitation requires no user interaction. The patch referenced is ALPS07629585 (Issue ALPS076295...

CVE-2023-30865

CVE-2023-30865 affects the dialer service where a missing permission check can allow local information disclosure without extra privileges. The common description across sources states the root cause is inadequate permission verification, enabling disclosure with low attack complexity and local a...

CVE-2023-30918

CVE-2023-30918 : The issue is a missing permission check in the telephony service, enabling local information disclosure without additional privileges. Connected sources identify affected UNISOC chipsets/telephony implementations (e.g., SC9863A, SC9832E, SC7731E, T610, T310, T606, T760, T618, T60...

CVE-2023-30932

CVE-2023-30932 affects the telephony service with a missing permission check that enables local information disclosure without extra execution privileges. Public coverage in connected documents references UNISOC chipsets (e.g., SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612/T616/T820/S8000...

CVE-2023-30935

CVE-2023-30935 affects the telephony service and is tied to a missing permission check that enables local information disclosure without additional execution privileges. Root cause: permission check gap in the telephony component. Impact: local confidentiality disclosure (C/H) with no privilege o...

CVE-2023-33880

CVE-2023-33880 describes a missing permission check in the music service that can lead to local information disclosure without additional execution privileges. Public-environment details indicate affected UNISOC-based devices (e.g., SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612/T616/T770/...

CVE-2023-33896

CVE-2023-33896 affects the libimpl-ril component. A missing bounds check can cause an out-of-bounds write, leading to local denial of service with System execution privileges required. The issue has a CVSSv3.1 base score of 4.4 (Medium) and is characterized as a local attack with high privileges ...

CVE-2023-38443

CVE-2023-38443 affects vowifiservice. The root cause is a missing permission check, enabling local privilege escalation without additional execution privileges. CVSSv3.1 vectors indicate Local access, Low attack complexity, Low privileges required, with High impact on confidentiality, integrity, ...

CVE-2023-38447

CVE-2023-38447 affects vowifiservice. Connected documents confirm a missing permission check in vowifiservice as the root cause, enabling a local denial of service with no additional execution privileges. Impact is described as DoS on the local host; no remote code execution or privilege escalati...

CVE-2023-38448

CVE-2023-38448 involves the vowifiservice component. The connected documents describe a possible missing permission check in vowifiservice, leading to a local denial of service with no additional execution privileges. The public details specify a local attack vector with low attack complexity and...

CVE-2023-38461

The CVE-2023-38461 entry concerns vowifiservice with a missing permission check, leading to local denial of service without extra privileges. Affected component: vowifiservice (on UNISOC-derived platforms as reflected in multiple sources). Root cause: insufficient authorization checks in the serv...

CVE-2023-38463

CVE-2023-38463 affects vowifiservice, where a missing permission check could allow local denial of service without requiring additional privileges. The NVD entry maps a local attack vector with low complexity and low privileges needed, resulting in availability impact (DoS) with no confidentialit...

CVE-2023-38467

CVE-2023-38467 affects the urild service and is caused by a missing bounds check that enables an out-of-bounds write. This can lead to a local denial of service with SYSTEM privileges required. Reported CVSSv3.1 vector (L/L/H/N/U) indicates local access, low complexity, high privileges required, ...

CVE-2023-40641

The vulnerability CVE-2023-40641 affects the Messaging component (notably on UNISOC chipsets per linked sources). The issue is a missing permission check in Messaging which could allow local information disclosure without requiring additional execution privileges. The cited sources collectively d...

CVE-2023-42691

Technical details about CVE-2023-42691 are not publicly provided in the connected documents. The sources only reiterate a missing permission check in the wifi service. Monitor for updates for affected products, root cause, impact, and fixes.

CVE-2023-42696

CVE-2023-42696 involves a missing permission check in the telecom service, enabling local escalation of privilege with no extra execution privileges required. The vulnerability is reported with a LOCAL attack vector and LOW privileges required, yielding a high impact on confidentiality, integrity...

CVE-2023-42736

CVE-2023-42736 concerns a missing permission check in the telecom service, leading to local privilege escalation with no extra privileges required. The connected documents (Red Hat, NVD, PRION/PRIO listing, and related vendor entries) consistently describe the issue as a telecom-service permissio...

CVE-2023-48345

The CVE-2023-48345 entry concerns a vulnerability in the video decoder where improper input validation can trigger an out-of-bounds read, potentially causing a local denial of service. The issue is described as allowing local access with no additional privileges required, with attack vector Local...

CVE-2024-40664

CVE-2024-40664 describes a logic error in setupAccessibilityServices within AccessibilityFragment.java that may allow hiding an enabled accessibility service, potentially causing local denial of service without extra privileges or user interaction. The vulnerability is documented across multiple ...

CVE-2025-20801

In seninf, a race condition can cause memory corruption leading to local privilege escalation when a user already has System privileges. No user interaction is required. A patch is available (Patch ID: ALPS10251210; Issue ID: MSV-4926). The issue is documented across multiple feeds (NVD, Red Hat,...

CVE-2025-20803

CVE-2025-20803 affects the dpe component. The issue is a memory corruption caused by an integer overflow that could allow local escalation of privilege when the attacker already has System privileges; exploitation requires user interaction. A patch is identified as ALPS10199779 (MSV-4504). Public...

CVE-2025-22414

CVE-2025-22414 concerns a local elevation of privilege in FrpBypassAlertActivity.java due to a missing permission check, enabling FRP bypass without user interaction. Public sources identify the Wear OS/System component context and classify the issue as High severity with local access required (A...

CVE-2025-26454

CVE-2025-26454 concerns a flaw in the Android component DisclaimersParserImpl.java, where a confused deputy could allow access to data from other users, enabling local privilege escalation without extra execution privileges or user interaction. The public records consistently describe the issue a...

CVE-2025-36895

CVE-2025-36895 is an information-disclosure vulnerability documented in the Pixel security bulletin, affecting the WLAN subcomponent. The Android bulletin lists it under Pixel with type ID, High severity, and affected as WLAN. The CVSSv3.1 vector indicates a Network attack vector, with Low attack...

CVE-2025-36899

CVE-2025-36899 affects Google Pixel devices, with a local elevation-of-privilege (EoP) flaw in the Secure Element component. It stems from test/debugging code left in a production build, allowing privilege escalation without additional execution privileges or user interaction (per the CVE entry a...

CVE-2025-36909

CVE-2025-36909 is an information-disclosure vulnerability affecting WLAN in Google Pixel devices as described in the Pixel update bulletin. According to NVD and cross‑references, this issue is classified as Information disclosure with a CVSS 3.1 base score of 5.3 (Medium). The entry indicates an ...