CVE-2025-48531

CVE-2025-48531 affects CredentialStorage in Android. A logic error in getCallingPackageName enables a permission bypass, leading to local escalation of privilege with no extra execution privileges or user interaction required. Connected sources confirm the issue but do not provide specific exploi...

CVE-2025-48551

CVE-2025-48551 involves an information-disclosure flaw in Android where an image can leak across the User isolation boundary due to a confused deputy. The vulnerability is local (AV:L/AC:L/PR:L/UI:R), requires user interaction, and could expose confidential data (C:H/I:N/A:N) without executing co...

CVE-2025-48630

CVE-2025-48630 describes an information-disclosure vulnerability in Skia’s drawLayersInternal (SkiaRenderEngine.cpp) that could grant a local attacker access to GPU cache data, enabling local escalation of privilege with no extra privileges or user interaction required. Public documents consisten...

CVE-2025-48645

CVE-2025-48645 concerns Google Android. The vulnerability arises from an improper input validation in the Android framework’s DeviceAdminInfo.loadDescription, allowing a malicious local attacker to achieve local elevation of privilege without user interaction. The impact is described as persisten...

CVE-2026-0024

The CVE-2026-0024 issue is in Android’s MediaProvider.java (isRedactionNeededForOpenViaContentResolver). A missing permission check could reveal the location of media, causing local information disclosure with no extra privileges and without user interaction. The connected sources (NVD, Red Hat, ...

CVE-2026-0071

Summary: CVE-2026-0071 affects SettingsLib where a logic error may skip a permission check, enabling local escalation of privilege with no additional privileges or user interaction required. The vulnerability is described across NVD, ENISA EUVD, CVE records, and PT/security bulletins, all citing ...

CVE-2026-0093

Technical details for CVE-2026-0093 are not publicly available in the provided documents (no affected products, fixes, or exploit info). Monitor for updates from official sources.

CVE-2026-0152

CVE-2026-0152 affects the OSMMapPMRGeneric path in pmr_os.c. A logic error may allow abusing a system-call sequence to expand the VMA out of bounds, enabling local privilege escalation with no extra privileges or user interaction required. Documented impact is high for confidentiality, integrity,...

CVE-2018-11956

Technical details about CVE-2018-11956 are not provided in the connected documents. The sources present only the general issue without specifics (affected components, root cause, impact, or fixes). Monitor for updates.

CVE-2018-5888

CVE-2018-5888 affects Qualcomm bootloader components (Bootloader) with Elevation of Privilege (EoP) and Moderate severity. The CVE description references an out-of-bounds access while processing the system path in CAF Android MSM Linux kernel prior to the 2018-06-05 patch level; connected data al...

CVE-2023-33900

CVE-2023-33900 : In the telephony service, a missing permission check allows local information disclosure without extra privileges (CVSS 3.1: Local access, High confidentiality impact, Medium overall). Affected scope is described as the telephony component; some connected sources reference UNISOC...

CVE-2023-38439

CVE-2023-38439 concerns a vulnerability in vowifiservice characterized by a possible missing permission check, which could enable local information disclosure without requiring additional execution privileges. The connected documents consistently reference vowifiservice as the affected component ...

CVE-2023-38456

CVE-2023-38456 affects vowifiservice with a missing permission check that can lead to local privilege escalation (no extra execution privileges required). This is described across multiple sources as a local escalation vulnerability with a base CVSS v3.1 score of 7.8 (HIGH) and LOCAL attack vecto...

CVE-2023-38457

CVE-2023-38457 affects vowifiservice. The vulnerability is caused by a missing permission check in vowifiservice, allowing local denial of service with no extra execution privileges. CVSS metrics indicate local attack vector, low attack complexity, and low privileges required, with availability i...

CVE-2023-38460

Summary of CVE-2023-38460 : Multiple connected sources identify a vulnerability in vowifiservice (linked to Unisoc chipsets) caused by a possible missing permission check. The underlying issue enables local privilege escalation with no additional execution privileges, with CVSS/metrics indicating...

CVE-2023-42674

CVE-2023-42674 affects the IMS service (imsservice) in UNISOC chipsets. The vulnerability arises from a missing permission check that permits writing permission usage records for an app, enabling local information disclosure without requiring additional execution privileges. Multiple sources corr...

CVE-2023-42681

CVE-2023-42681 affects the ion service in Unisoc chipsets, where a missing permission check can allow local escalation of privilege without requiring additional execution privileges. The issue is rooted in the ion service’s access control, enabling a local attacker with low privileges to exploit ...

CVE-2023-42683

CVE-2023-42683 affects the gsp driver in UNISOC chipsets, caused by a missing bounds check that enables an out-of-bounds read. The consequence stated in sources is local denial of service with SYSTEM-level privileges required. Connected documents corroborate the issue in the gsp driver across mul...

CVE-2023-42687

CVE-2023-42687 : The wifi service contains a missing permission check that could enable local escalation of privilege with no additional execution privileges required. The available data from the CVE entry indicates a local exploit path with a high impact (Confidentiality/Integrity/Availability H...

CVE-2023-42694

CVE-2023-42694 concerns the wifi service on UNISOC chipsets, with a reported missing permission check in the wifi service. The cited impact is local escalation of privilege requiring no additional execution privileges, and the CVSSv3.1 base metrics indicate a HIGH severity (AV:L/AC:L/PR:L/UI:N/S:...

CVE-2023-42702

CVE-2023-42702 describes a missing permission check in the firewall service that allows an attacker with local access to write permission usage records for an app, causing local information disclosure with no additional execution privileges. Affected: firewall service in UNISOC chipsets. Impact: ...

CVE-2023-42706

CVE-2023-42706 affects the firewall service, where a missing permission check can allow an attacker to write permission usage records for an app, enabling local information disclosure without extra execution privileges. Root cause: inadequate authorization in the firewall service. Impact: confide...

CVE-2023-42708

CVE-2023-42708 affects the firewall service, where a missing permission check could allow writing an app’s permission usage records, leading to local information disclosure without extra execution privileges. The issue is documented across multiple sources (NVD/Red Hat/PRion/CVE lists) and is ass...

CVE-2023-42711

The CVE-2023-42711 entry concerns a vulnerability in the firewall service where a missing permission check allows an app to write permission usage records, causing local information disclosure with no extra execution privileges required. Affected component: firewall service (general description a...

CVE-2023-42712

Consolidated data for CVE-2023-42712 from multiple sources confirms a vulnerability in the firewall service of UNISOC chipsets. The root cause is a missing permission check that could allow an app to write permission usage records, enabling local information disclosure without requiring additiona...

CVE-2023-42713

CVE-2023-42713 affects UNISOC chipsets’ firewall service, where a missing permission check enables an app to write permission usage records. Root cause: inadequate authorization on the firewall service, allowing local information disclosure without extra execution privileges. Impact: local inform...

CVE-2023-42719

CVE-2023-42719 affects a component described as a video service, where an incorrect bounds check can cause an out-of-bounds read leading to local denial of service. The primary sources consistently state the issue as a local condition with no explicit remote vector or exploitation details provide...

CVE-2023-42721

The CVE-2023-42721 entry concerns the flv extractor component, where missing input validation is the reported root cause. This vulnerability could allow local denial of service without requiring user interaction or additional privileges, as described in multiple connected records (notably the Red...

CVE-2023-42732

Technical details about CVE-2023-42732 are not publicly available in the provided connected documents; monitor for updates from vendors and security advisories.

CVE-2023-42744

CVE-2023-42744 concerns a missing permission check in a telecom service, enabling local denial of service without additional privileges. From NVD, the CVSSv3.1 base score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Exploitation details are not provided in the supplied documents, and no explicit...

CVE-2023-48346

CVE-2023-48346 affects the video decoder component in UNISOC chipsets. The root cause is improper input validation, which could allow local denial of service without additional execution privileges. The available documents describe the impact as local and do not specify exploit details or a fixed...

CVE-2025-0076

Google Android CVE-2025-0076 describes an information-disclosure flaw where a missing permission check could allow viewing icons belonging to another user. Exploitation requires local access with no user interaction, aligning with the CVSS local access and low impact (C:L, I:N, A:N). Connected so...

CVE-2025-20693

The CVE-2025-20693 issue affects the wlan STA driver, with an out-of-bounds read caused by an incorrect bounds check. This vulnerability could allow remote information disclosure from proximal access without extra privileges or user interaction. The impact is described as high confidentiality ris...

CVE-2025-32330

CVE-2025-32330 : The issue is in generateRandomPassword of LocalBluetoothLeBroadcast.java, where an insecure default value can allow a nearby attacker to intercept the Auracast audio stream, causing remote information disclosure without extra privileges or user interaction. The connected document...

CVE-2025-32346

CVE-2025-32346 pertains to VoicemailSettingsActivity.java in Android, where a confused deputy allows disclosure of work profile contact numbers, enabling local escalation of privilege with no additional privileges and no user interaction required. The connected documents reiterate the same root c...

CVE-2025-36897

CVE-2025-36897 involves an out-of-bounds write in cd_CnMsgCodecUserApi.cpp due to a missing bounds check, enabling remote code execution without extra privileges and without user interaction. Public sources (Pixel bulletin) classify the issue as RCE with High severity and note a 2025-09-05 patch ...

CVE-2025-48526

The CVE-2025-48526 affects ChooserActivity.java in Android’s Chooser component, where createMultiProfilePagerAdapter allows launching into another user profile due to improper input validation. The risk is local elevation of privilege with no required user interaction, and exploitation is local (...

CVE-2025-48529

The CVE-2025-48529 issue affects VoicemailNotificationSettingsUtil.java, specifically the setRingtoneUri function, causing a cross-user data leak (confused deputy) that can disclose local information without extra privileges. Exploitation requires no user interaction and is local. The connected d...

CVE-2025-48537

CVE-2025-48537 affects Google Android and is described as a locally exploitable DoS due to improper input validation in multiple locations, which can also lead to local information disclosure without additional privileges or user interaction. Android security bulletins associate this and related ...

CVE-2025-48574

CVE-2025-48574 affects Android’s UI component: DisplayPolicy.java (validateAddingWindowLw). The issue arises from a missing permission check, allowing an app to intercept drag-and-drop events and perform local elevation of privilege without extra execution privileges or user interaction. Public d...

CVE-2025-48631

CVE-2025-48631 affects Google Android (LocalImageResolver.java: onHeaderDecoded). The issue is a DoS caused by resource exhaustion, enabling remote denial of service with network access and no user interaction. Connected advisories confirm updates in Android and Samsung devices as fixes; patch le...

CVE-2026-0028

CVE-2026-0028 affects the Linux kernel code path __pkvm_host_share_guest in mem_protect.c, where an integer overflow can cause an out-of-bounds write. This leads to local privilege escalation without user interaction. The existing references in the connected documents (Android kernel changes and ...

CVE-2026-0099

Technical details about CVE-2026-0099 are not publicly available in the provided connected documents. Monitor for updates from official sources; no further specifics (affected products, root cause, impact, or fixes) are disclosed here.

CVE-2026-0100

CVE-2026-0100 : The description across NVD, OSV, and vuln enrichment indicates a vulnerability in the Load path of LoadedArsc.cpp causing an out-of-bounds write via a heap buffer overflow. This can enable local privilege escalation with no extra execution privileges required; exploitation is poss...

CVE-2026-28586

CVE-2026-28586 : All connected documents describe the issue as a permission bypass in multiple functions of AppOpsService.java , causing a possible local information disclosure without requiring additional execution privileges. The description consistently notes no user interaction is needed for ...

CVE-2022-48464

CVE-2022-48464 concerns UNISOC chipsets with a vulnerability in the wifi service: an out-of-bounds write caused by a missing bounds check, enabling local denial of service with no extra privileges. Exploitation details, affected versions, and concrete fixes are not specified in the provided docum...

CVE-2023-30931

CVE-2023-30931 involves a missing permission check in the telephony service that could allow local information disclosure without additional execution privileges. The issue is described across multiple sources as affecting UNISOC chipsets (telephony component), with attack vector LOCAL, attack co...

CVE-2023-38451

The CVE-2023-38451 entry describes a vulnerability in vowifiservice caused by a missing permission check, enabling local privilege escalation with no additional execution privileges. Reported impact includes high confidentiality/integrity/availability concerns and a CVSS v3.1 base score of 7.8 (L...

CVE-2023-38453

Technical details about CVE-2023-38453 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2023-38466

The CVE-2023-38466 entry describes a vulnerability in the ims service of UNISOC chipsets where a missing permission check could allow local information disclosure without requiring additional privileges. The issue is documented across multiple feeds (NVD/Red Hat/CVE/CNNVD) with the same core desc...