CVE-2023-30927

Summary : CVE-2023-30927 is a local information disclosure vulnerability due to a missing permission check in the telephony service. The NVD entry reports a CVSSv3.1 base score of 5.5 (LOW privileges required, LOCAL exploit, HIGH confidentiality impact). Connected sources corroborate the issue an...

CVE-2023-30932

CVE-2023-30932 affects the telephony service with a missing permission check that enables local information disclosure without extra execution privileges. Public coverage in connected documents references UNISOC chipsets (e.g., SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612/T616/T820/S8000...

CVE-2023-32861

CVE-2023-32861 affects MediaTek devices with a flaw in the display module due to an incorrect bounds check, causing an out-of-bounds read that could enable local escalation of privileges with System execution privileges required. No user interaction is needed. Patch: ALPS08059081 (Issue ID: ALPS0...

CVE-2023-32868

CVE-2023-32868 concerns MediaTek’s display DRM module, with a missing bounds check causing an out-of-bounds write. The vulnerability is described as allowing local escalation of privileges to System level, with no user interaction required. Reported patch: ALPS07363632 (Issue ALPS07363632). Conne...

CVE-2023-33886

CVE-2023-33886 affects the telephony service where a missing permission check can cause local information disclosure without additional execution privileges. The CVE's base metrics show Local attack vector, Low attack complexity, Low privileges required, no user interaction, and Confidentiality i...

CVE-2023-33893

The CVE-2023-33893 entry concerns a privilege-check bypass in the fastDial service that can enable local information disclosure without additional execution privileges. Public sources consistently describe the issue as a missing permission check leading to exposure of data, with an overall CVSSv3...

CVE-2023-33904

CVE-2023-33904 affects the hci_server component. The root cause is a missing bounds check that enables an out-of-bounds read, which can lead to local denial of service with system execution privileges required. Multiple databases corroborate this vulnerability and cite the same description. Affec...

CVE-2023-33913

CVE-2023-33913 describes a vulnerability in the DRM/oemcrypto module where an incorrect calculation of the buffer size allows an out-of-bounds write. This could lead to remote escalation of privilege with system execution privileges required. The initial documents confirm the issue and its impact...

CVE-2023-38448

CVE-2023-38448 involves the vowifiservice component. The connected documents describe a possible missing permission check in vowifiservice, leading to a local denial of service with no additional execution privileges. The public details specify a local attack vector with low attack complexity and...

CVE-2023-38458

In the provided documents, CVE-2023-38458 affects vowifiservice (Unisoc/UNISOC chipsets) with a possible missing permission check that could enable local escalation of privilege. The NVD entry describes the impact as local escalation with no extra execution privileges, and the attack vector is LO...

CVE-2023-38463

CVE-2023-38463 affects vowifiservice, where a missing permission check could allow local denial of service without requiring additional privileges. The NVD entry maps a local attack vector with low complexity and low privileges needed, resulting in availability impact (DoS) with no confidentialit...

CVE-2023-42652

CVE-2023-42652 affects the UNISOC/engineermode context. The root cause is a missing permission check in engineermode, enabling local information disclosure with no additional execution privileges. Impact aligns with the CVSS note: local attacker access to confidential data; exploitation status no...

CVE-2023-42740

CVE-2023-42740 - A missing permission check in the telecom service allows writing permission usage records, enabling local escalation of privilege without extra execution privileges. The issue is documented across multiple sources (NVD, Red Hat, PRION, CNNVD, etc.) and is associated with UNISOC t...

CVE-2023-42747

Consolidated details indicate a vulnerability in Unisoc chipsets where the camera service may lack a required permission check. This can enable local escalation of privilege without additional execution privileges. Affected component appears to be the camera service in Unisoc chipsets; no explici...

CVE-2025-0089

CVE-2025-0089 affects the Android Launcher application and is described as a logic error that can enable local escalation of privilege without user interaction. The issue is listed in the Android security bulletin with high severity (EoP) for Framework and related components, and patch levels 202...

CVE-2025-48548

CVE-2025-48548 describes a race condition in AppOpsControllerImpl.java that could allow recording audio without the privacy indicator, enabling local elevation of privilege with user interaction required. The issue is discussed across multiple sources (Android/Red Hat/CNVD views) with the same co...

CVE-2025-48559

CVE-2025-48559 affects Google Android’s AppOpsService.java. The vulnerability arises from improper input validation in multiple internal functions, enabling an attacker to add a large number of app ops. This can cause a local denial of service with no extra privileges and without user interaction...

CVE-2025-48561

Technical details about CVE-2025-48561 are not provided in the connected documents. Monitor for updates.

CVE-2025-48565

The CVE-2025-48565 entry describes a logic error in Android’s cross-profile intent filtering, enabling local escalation of privilege without extra execution privileges or user interaction. Affected component is the Framework/IntentResolver logic in multiple Android locations, with exploitation de...

CVE-2026-0052

Technical details (affected product/component/version, root cause, exploit status) are not provided in the connected documents. Monitor for updates from sources linked to CVE-2026-0052.

CVE-2026-0089

The CVE-2026-0089 issue affects the PackageInstallerService.java component and enables installation of unverified apps due to a missing permission check, enabling local privilege escalation with no extra execution privileges required and no user interaction needed. The core impact is local escala...

CVE-2018-5847

CVE-2018-5847 describes a use-after-free condition arising from early/late retirement of rotation requests in CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Affected software is Android CAF kernel components; the underlying issue is a memory-managem...

CVE-2018-5851

CVE-2018-5851 is a Qualcomm WLAN buffer-overflow vulnerability affecting Android devices (Pixel/Nexus) due to HTT_T2H_MSG_TYPE_TX_COMPL_IND processing with an out-of-range num_msdus. The issue can allow arbitrary code execution or a DoS. Public details map this CVE to Qualcomm WLAN in the May 201...

CVE-2018-5910

CVE-2018-5910: In CAF-built Android (Android for MSM, Firefox OS for MSM, QRD Android) kernels, memory corruption can occur due to an improper check of the callers count parameter in display handler code. The issue affects the Linux kernel components used by CAF in these Android releases. Root ca...

CVE-2019-2171

CVE-2019-2171 affects Android 10, specifically the libxaac library, due to uninitialized data leading to information disclosure. The issue allows an attacker to disclose information without extra execution privileges; exploitation requires user interaction. Documents confirm impact on Android-10 ...

CVE-2019-9389

CVE-2019-9389 affects Android 10 Bluetooth stack (Bluetooth component) with a out-of-bounds read due to a missing bounds check. This could lead to remote denial of service without user interaction. CVSSv2 base score 5.0 (NETWORK, LOW attack complexity, no privileges required, Availability impact ...

CVE-2019-9390

CVE-2019-9390 affects Android 10 Bluetooth stack. The defect is an out-of-bounds read due to a missing bounds check, enabling remote denial of service without privileges or user interaction. Impact is supported by NVD metrics (CVSSv3.1 base score 7.5, HIGH; network attacker with no auth, no UI). ...

CVE-2020-0244

CVE-2020-0244 affects Android 11, describing an out-of-bounds read in SPDIFEncoder.cpp (writeBurstBufferBytes) caused by an incorrect bounds check. This can lead to local information disclosure without a clear exfiltration path; exploitation requires user interaction. The NVD entry lists CVSS det...

CVE-2021-0408

In CVE-2021-0408, the issue is a possible out-of-bounds read in the asf extractor caused by an incorrect bounds check. This could lead to local information disclosure without additional privileges or user interaction. The vulnerability is documented across multiple sources (NVD/Red Hat/NVD_PAIR/e...

CVE-2023-20761

CVE-2023-20761 concerns the ril component with an out-of-bounds write due to a missing bounds check, enabling local privilege escalation to System level. Exploitation is described as locally achievable without user interaction. Reported impact tiers include confidentiality, integrity, and availab...

CVE-2023-21232

CVE-2023-21232 corresponds to a permissions-bypass information-disclosure issue affecting Wear OS and related Android components. The vulnerability allows retrieval of sensor data without permission, with local access and no user interaction required. Exploitation details (vector, affected versio...

CVE-2023-21233

CVE-2023-21233 concerns the avrc module in Wear OS. The vulnerability arises from uninitialized data in multiple locations, enabling a heap data leak that could lead to remote information disclosure with no additional execution privileges needed. Exploitation is possible without user interaction ...

CVE-2023-32863

CVE-2023-32863 describes a vulnerability in the display DRM where a missing bounds check can lead to an out-of-bounds read, enabling local escalation of privileges with System execution privileges needed. User interaction is not required. The CVE is mitigated by Patch ID ALPS07326314 (Issue ID AL...

CVE-2023-33917

CVE-2023-33917 : Multiple sources describe a vulnerability in vowifiservice due to a possible missing permission check, leading to local information disclosure with no additional execution privileges. The impact is described as information disclosure, with a local attack vector and low attack com...

CVE-2023-38440

CVE-2023-38440 concerns a missing permission check in vowifiservice, enabling local information disclosure with no extra privileges. The observed impact is local disclosure; CVSS indicates local attack vector, low privileges required, low attack complexity, with high confidentiality impact. Publi...

CVE-2023-38442

CVE-2023-38442 affects vowifiservice. The issue is a missing permission check that could lead to local information disclosure with no additional execution privileges. CVSS v3.1 base score 5.5 (Medium) with LOCAL attack vector, low attack complexity, low privileges required, and high confidentiali...

CVE-2023-38455

The CVE-2023-38455 entry concerns a vulnerability in vowifiservice where a missing permission check could permit local privilege escalation (attack vector: LOCAL; privileges required: LOW; user interaction: NONE). The published NVD entry shows a CVSS v3.1 base score of 7.8 (HIGH) with impacts to ...

CVE-2023-42686

Technical details about CVE-2023-42686 are not publicly available in the provided connected documents. Monitor for updates for affected products, components, and remediation specifics.

CVE-2023-42691

Technical details about CVE-2023-42691 are not publicly provided in the connected documents. The sources only reiterate a missing permission check in the wifi service. Monitor for updates for affected products, root cause, impact, and fixes.

CVE-2023-42696

CVE-2023-42696 involves a missing permission check in the telecom service, enabling local escalation of privilege with no extra execution privileges required. The vulnerability is reported with a LOCAL attack vector and LOW privileges required, yielding a high impact on confidentiality, integrity...

CVE-2023-42715

CVE-2023-42715 affects UNISOC chipsets with a vulnerability in the telephony service caused by a missing permission check, enabling local information disclosure without requiring extra execution privileges. The CVSS entry cites local attack vector, low attack complexity, and low privileges requir...

CVE-2023-42723

CVE-2023-42723 concerns a vulnerability in camera services (Unisoc chipsets) caused by a missing bounds check leading to an out-of-bounds read. The NVD entry notes a local attack vector with low privileges required and no user interaction, resulting in local denial of service. Connected sources c...

CVE-2023-42730

CVE-2023-42730 describes a vulnerability in the IMS service where a missing permission check allows writing permission usage records, enabling local information disclosure without extra privileges. The NVD entry lists a CVSS 3.1 base score of 5.5 (Medium) with Local attack vector, Low attack comp...

CVE-2023-42731

CVE-2023-42731 affects the Gnss service in UNISOC chipsets. The vulnerability is an out-of-bounds read caused by a missing bounds check, leading to local denial of service with System execution privileges required. The CVSSv3.1 base score is 4.4 (Medium) with LOCAL attack vector, low attack compl...

CVE-2023-42751

CVE-2023-42751 affects the gnss service. The vulnerability is described as a missing bounds check that can cause an out-of-bounds write, leading to local denial of service with System execution privileges. The available connected documents confirm the issue and provide no explicit patch/version f...

CVE-2024-40664

CVE-2024-40664 describes a logic error in setupAccessibilityServices within AccessibilityFragment.java that may allow hiding an enabled accessibility service, potentially causing local denial of service without extra privileges or user interaction. The vulnerability is documented across multiple ...

CVE-2024-49714

CVE-2024-49714 is an elevation-of-privilege vulnerability in the AVRCP vendor message path: in avrc_vendor_msg within avrc_opt.cc, a heap-buffer overflow can cause an out-of-bounds write. This enables local escalation on a paired device without extra privileges or user interaction. Exploitation i...

CVE-2025-36899

CVE-2025-36899 affects Google Pixel devices, with a local elevation-of-privilege (EoP) flaw in the Secure Element component. It stems from test/debugging code left in a production build, allowing privilege escalation without additional execution privileges or user interaction (per the CVE entry a...

CVE-2025-36928

CVE-2025-36928 : The issue is a potential out-of-bounds write in GetHostAddress of gxp_buffer.h caused by an incorrect bounds check. This can enable local escalation of privilege with no extra execution privileges required and no user interaction needed. Affected reports appear in multiple feeds ...

CVE-2025-48522

CVE-2025-48522 is an elevation-of-privilege vulnerability in Android, caused by a logic error in the setDisplayName function of AssociationRequest.java that can allow an app to retain the CDM association. This can lead to local EoP with no additional execution privileges and requires no user inte...