CVE-2023-42673

CVE-2023-42673 concerns the imsservice component, where a missing permission check enables an app to potentially write permission usage records, causing local information disclosure with no extra execution privileges. The vulnerability is described across multiple feeds (NVD/Red Hat/CVE records) ...

CVE-2023-42676

CVE-2023-42676 affects the imsservice in UNISOC chipsets, where a missing permission check enables local information disclosure by writing permission usage records. The vulnerability is described with LOCAL attack vector, low privileges required, and high confidentiality impact (CVSS v3.1: 5.5, M...

CVE-2023-42698

CVE-2023-42698 affects the omacp service. A missing permission check could allow a local attacker to write an app’s permission usage records, causing local information disclosure (C: high). CVSSv3.1: 5.5 (MEDIUM), AV:L/AC:L/PR:L/UI:N/S:U. Exploitation details or affected product/version specifics...

CVE-2023-42701

CVE-2023-42701 affects UNISOC firewall service in UNISOC chipsets. The root cause is a missing permission check that can allow an attacker to write permission usage records for an app, resulting in local information disclosure without requiring additional execution privileges. The NVD entry lists...

CVE-2023-42704

CVE-2023-42704 affects imsservice in certain UNISOC-based environments. The root cause is a missing permission check that can allow an app to write permission usage records, enabling local information disclosure without requiring additional execution privileges. Reported impact aligns with NVD CV...

CVE-2023-42717

CVE-2023-42717 affects the telephony service where a missing permission check could allow remote information disclosure without additional privileges. The CVSS data indicates network attack vector, low complexity, no user interaction, with a high confidentiality impact (C:H, I:N, A:N) and unchang...

CVE-2023-42725

CVE-2023-42725 concerns the GPU driver with a missing bounds check that enables an out-of-bounds read and local denial of service with System execution privileges. This aligns across multiple sources (NVD, Red Hat, CVE lists) describing the same issue in the GPU driver; exploitation status is not...

CVE-2023-42728

CVE-2023-42728 affects the phasecheckserver component, where a missing bounds check can lead to an out-of-bounds read and local denial of service. Multiple sources (NVD, Red Hat, PRION, CVE lists, and vendor pages) corroborate the issue and the local-privilege aspect, with no public exploitation ...

CVE-2023-42738

CVE-2023-42738 involves the telocom service with a missing permission check that could allow local escalation of privilege. The NVD/Red Hat/PT-Security records describe a local-privilege escalation without requiring additional execution privileges. No concrete patch/version details are provided i...

CVE-2023-42748

CVE-2023-42748 refers to a missing permission check in the telecom service that can enable local privilege escalation without additional execution privileges. The vulnerability is characterized by local access (attack vector LOCAL), low privilege required, and no user interaction, with high confi...

CVE-2025-20781

The CVE-2025-20781 issue affects MediaTek chipsets’ display component, caused by a memory corruption due to use-after-free. This leads to local escalation of privilege if an attacker already has System privileges; exploitation does not require user interaction. A patch is listed as ALPS10182914 (...

CVE-2025-26434

CVE-2025-26434 involves libxml2 with a vulnerability described as an out-of-bounds read caused by a buffer overflow. The impact is local information disclosure without requiring privileges or user interaction, as stated in the public descriptions. Connected documents corroborate the root cause as...

CVE-2025-26464

CVE-2025-26464 is an elevation-of-privilege issue in Android tied to AppSearchManagerService.java (executeAppFunction). The described logic error could cause a background activity to launch, enabling local privilege escalation without user interaction. Documents consistently refer to this vulnera...

CVE-2025-32325

CVE-2025-32325 is a local elevation-of-privilege vulnerability in Android’s Parcel.cpp: in appendFrom, a heap-based out-of-bounds write could occur, enabling local privilege escalation without extra execution privileges or user interaction. Multiple connected sources (NVD/NCSC/CNVD/CVELIST, OSV) ...

CVE-2025-32326

CVE-2025-32326 describes a local elevation of privilege in Android via a confused deputy in AppRestrictionsFragment.java, enabling bypass of the intent security check. Impact is local with user interaction required; no additional execution privileges needed. Root cause: insecure bypass in multipl...

CVE-2025-48546

CVE-2025-48546 affects SafeActivityOptions.java. The issue arises during checkPermissions, enabling a possible background activity launch due to a logic error. This can lead to local escalation of privilege with no additional execution privileges required, and no user interaction needed for explo...

CVE-2025-48550

CVE-2025-48550 is a path traversal vulnerability in testGrantSlicePermission of SliceManagerTest.java that could cause a permanent Denial of Service locally, without user interaction. Exploitation is local and requires no additional privileges. The connected documents confirm the issue but do not...

CVE-2025-48554

CVE-2025-48554 affects Google Android (DevicePolicyManagerService.java). A logic error in handlePackagesChanged can cause a persistent DoS, with local impact and user interaction required for exploitation. No PoC details are provided in the documents. Remediation: apply the Android security patch...

CVE-2025-48563

CVE-2025-48563 covers an elevation-of-privilege flaw in Android caused by an insecure default value in onNullBinding of RemoteFillService.java. The issue can trigger a background activity launch without extra privileges or user interaction, enabling local privilege escalation. Public references c...

CVE-2025-48567

CVE-2025-48567 involves a bypass of a file path filter intended to restrict access to sensitive directories, caused by incorrect Unicode normalization. This can enable local escalation of privilege; exploitation requires user interaction. The CVE is referenced across multiple sources (NVD, Red Ha...

CVE-2026-0043

CVE-2026-0043 affects code paths in ubsan_throwing_runtime.cpp where an integer overflow can cause a persistent denial of service and local escalation of privilege without user interaction. The connected sources (NVD/NVD OSV/ENISA EUVD and related enrichments) consistently describe this flaw as a...

CVE-2026-0056

CVE-2026-0056 describes a read out of bounds in setTo of ResourceTypes.cpp, leading to local information disclosure without extra privileges. The issue is labeled as a low-severity, local vulnerability with no user interaction required. Concrete technical details beyond the affected file (Resourc...

CVE-2026-0070

CVE-2026-0070 affects Android’s DevicePolicyManagerService.java, where improper input validation can enable hiding a system critical package, causing a local denial of service without extra privileges. The available documents consistently describe the issue as a local DoS through the described co...

CVE-2026-0074

CVE-2026-0074 describes a potential denial of service via the getPreferredSize path in LauncherProcessImageListener.kt, where a resource exhaustion condition could be triggered locally. The available documents consistently report a DoS risk requiring local access, with no user interaction needed....

CVE-2023-33879

CVE-2023-33879 concerns a missing permission check in the music service leading to local information disclosure. Connected sources corroborate this as a privilege-check omission rather than remote execution. The CVE is associated with UNISOC chipsets (e.g., SC9863A, SC9832E, SC7731E, and others l...

CVE-2023-38437

CVE-2023-38437 affects the vowifiservice component. The connected documents describe a missing permission check in vowifiservice that could cause local information disclosure without requiring additional execution privileges. The impact is stated as local information disclosure and the attack vec...

CVE-2023-38441

CVE-2023-38441 affects vowifiservice. The root cause is a missing permission check, which could allow local information disclosure without requiring additional privileges. The issue is characterized by LOCAL attack vector, LOW exploit complexity, and MEDIUM base score (C: HIGH confidentiality imp...

CVE-2023-42675

CVE-2023-42675 affects imsservice (Unisoc-focused vulnerabilities). The issue arises from a missing permission check in imsservice, enabling an attacker to write permission usage records of an app and potentially disclose locally held information without additional execution privileges. Connected...

CVE-2023-42700

CVE-2023-42700 affects the firewall service on Unisoc chipsets, where a missing permission check allows an app to write permission usage records, leading to local information disclosure. The NVD report assigns CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (base score 5.5). Exploitation status is...

CVE-2023-42718

CVE-2023-42718 concerns the dialer module, where a missing permission check can allow an app to write permission usage records. The exposed root cause is inadequate access control in the dialer’s permission handling, enabling local information disclosure without additional execution privileges. T...

CVE-2023-42734

The CVE-2023-42734 entry describes a vulnerability in the telephony service where a missing permission check can lead to local information disclosure without requiring additional execution privileges. Affected component: telephony service (platform-level). Root cause: insufficient access control ...

CVE-2023-42742

CVE-2023-42742 affects the sysui component (UNISOC chipsets). The root cause is a missing permission check, enabling a local denial‑of‑service with no additional execution privileges required. The documented impact is local DoS with high availability impact; exploitation status is not provided in...

CVE-2023-42743

CVE-2023-42743 involves a missing permission check in a telecom service, enabling local privilege escalation with no additional execution privileges needed. The connected sources indicate UNISOC chipsets are implicated, tying the issue to telecom functionality on those platforms. Documented impac...

CVE-2023-42745

Technical details (affected product/component/versions/root cause) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2023-42746

CVE-2023-42746 is described as a local privilege-escalation due to a missing permission check in the power manager. The NVD entry notes local attack vector with low privileges required and no user interaction, and a high impact on confidentiality, integrity, and availability (CVSS 3.1 base score ...

CVE-2025-26419

CVE-2025-26419 affects the Wear OS/Android component SystemSettingsFragment.java (initPhoneSwitch). A logic error enables a Factory Reset Protection (FRP) bypass, potentially allowing local elevation of privilege. Exploitation requires user interaction; no additional execution privileges are need...

CVE-2025-26454

CVE-2025-26454 concerns a flaw in the Android component DisclaimersParserImpl.java, where a confused deputy could allow access to data from other users, enabling local privilege escalation without extra execution privileges or user interaction. The public records consistently describe the issue a...

CVE-2025-32323

CVE-2025-32323: In Shared.java getCallingAppName, input validation allows deceptive permission-popup text to trick users into granting file access. This enables local elevation of privilege, with no additional execution privileges and no user interaction required. Affected: Android framework code...

CVE-2025-32324

The CVE-2025-32324 entry concerns the Android ActivityManagerShellCommand.java onCommand path, where a confused deputy could allow arbitrary activity launches and lead to local privilege escalation. The underlying issue enables exploitation with no extra execution privileges and without user inte...

CVE-2025-32348

CVE-2025-32348 affects Android devices. The underlying issue is a missing permission check in multiple locations that can allow a background activity to be launched, enabling local elevation of privilege without additional execution privileges, and no user interaction is required to exploit. The ...

CVE-2025-32349

CVE-2025-32349 is a local elevation-of-privilege issue in Google Android, arising from a tapjacking/overlay scenario. The vulnerability allows local escalation without additional execution privileges and requires no user interaction. Public references indicate it affects Android platform componen...

CVE-2025-36896

CVE-2025-36896 affects WLAN on Google Pixel devices running Android prior to the 2025-09-05 patch level. The issue is an elevation of privilege in the WLAN component; CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction required. The Pixel security bulletin groups th...

CVE-2025-36907

CVE-2025-36907 affects the Android Pixel stack: a heap buffer overflow in the draw_surface_image() function of abl/android/lib/draw/draw.c allows an out-of-bounds write. This can lead to local elevation of privilege via USB fastboot after a bootloader unlock, with no additional execution privileg...

CVE-2025-48532

Affected software: Android MediaProvider.java (markMediaAsFavorite).Root cause: a confused deputy flaw allows bypassing the WRITE_EXTERNAL_STORAGE permission, enabling local elevation of privilege.Impact: elevates privileges locally with high confidentiality, integrity and availability implicatio...

CVE-2025-48534

CVE-2025-48534 affects Android’s CellBroadcast handling code. In getDefaultCBRPackageName of CellBroadcastHandler.java, a logic error may allow privilege escalation, yielding local denial of service with System execution privileges and no user interaction required. Current connected sources confi...

CVE-2025-48541

CVE-2025-48541 : In the Android code path, the bug occurs in the onCreate of FaceSettings.java, where improper input validation can remove biometric unlock across user profiles. This enables local escalation of privilege with no additional execution privileges required, and exploitation does not ...

CVE-2026-0014

CVE-2026-0014 affects AppOpsService.java (method isPackageNullOrSystem) and describes a possible persistent denial of service due to improper input validation. The issue enables local DoS without user interaction or privileges, as indicated in multiple sources. Exploitation status and specific ex...

CVE-2026-0016

CVE-2026-0016 affects CredentialManagerService.java (updateProvidersWhenServiceRemoved). The vulnerability arises from a permissions bypass that could allow overriding settings across users, causing local information disclosure with no extra execution privileges required. Exploitation status is n...

CVE-2026-0063

CVE-2026-0063 affects the Android framework component PhoneInterfaceManager.java, where a logic error in setAllowedCarriers could disable carrier restrictions, enabling local privilege escalation with no additional privileges and no user interaction required. The issue is cataloged as an Elevatio...

CVE-2026-0150

CVE-2026-0150 affects EdgeTPU firmware, specifically the ExecuteGraph command handler. The issue is a possible out-of-bounds write caused by an integer overflow, enabling local escalation of privilege with root privileges required. Exploitation does not require user interaction. The available con...