CVE-2026-0141

CVE-2026-0141 describes a likely out-of-bounds read in decodeAppPacket of RtcpAppPacket.cpp caused by a missing bounds check. The vulnerability enables a remote information disclosure without requiring additional execution privileges and without user interaction. Public references in the provided...

CVE-2026-0148

The connected sources confirm a concrete issue in VideoRtpPayloadDecoderNode.cpp: an integer overflow can cause an out-of-bounds write, enabling remote code execution without extra privileges or user interaction. Affected component is VideoRtpPayloadDecoderNode.cpp (multiple functions). The CVE e...

CVE-2018-11911

Affected software : Android releases (Android for MSM, Firefox OS for MSM, QRD Android) built with CAF Linux kernel. Root cause : improper configuration of a script, as described in CNVD-2018-25313. Impact : potential unprivileged access / privilege access control vulnerability. References in con...

CVE-2018-11913

Technical details for CVE-2018-11913 are not publicly provided in the connected documents. The available records reiterate a generic issue related to dev node configuration in CAF/Linux kernel builds. Monitor for updates from official advisories.

CVE-2018-5908

CVE-2018-5908 affects CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The root cause is a missing buffer length validation in a display function, enabling a potential buffer overflow. CVSS indicates a local, low-complexity attack with HIGH impact acro...

CVE-2019-2146

CVE-2019-2146 affects Android 10, with a vulnerability in libxaac caused by a missing bounds check that leads to an out-of-bounds read. Consequence: information disclosure without execution privileges; exploitation requires user interaction. Affected component: libxaac (Android 10). Vendor/OS con...

CVE-2019-2163

Concerning CVE-2019-2163, multiple connected sources confirm a concrete issue in the Android 10 libxaac library: an out-of-bounds read due to a missing bounds check, leading to information disclosure. Affected component: libxaac within Android-10. Impact per sources: potential information leakage...

CVE-2019-9390

CVE-2019-9390 affects Android 10 Bluetooth stack. The defect is an out-of-bounds read due to a missing bounds check, enabling remote denial of service without privileges or user interaction. Impact is supported by NVD metrics (CVSSv3.1 base score 7.5, HIGH; network attacker with no auth, no UI). ...

CVE-2023-21233

CVE-2023-21233 concerns the avrc module in Wear OS. The vulnerability arises from uninitialized data in multiple locations, enabling a heap data leak that could lead to remote information disclosure with no additional execution privileges needed. Exploitation is possible without user interaction ...

CVE-2023-30931

CVE-2023-30931 involves a missing permission check in the telephony service that could allow local information disclosure without additional execution privileges. The issue is described across multiple sources as affecting UNISOC chipsets (telephony component), with attack vector LOCAL, attack co...

CVE-2023-32861

CVE-2023-32861 affects MediaTek devices with a flaw in the display module due to an incorrect bounds check, causing an out-of-bounds read that could enable local escalation of privileges with System execution privileges required. No user interaction is needed. Patch: ALPS08059081 (Issue ID: ALPS0...

CVE-2023-32868

CVE-2023-32868 concerns MediaTek’s display DRM module, with a missing bounds check causing an out-of-bounds write. The vulnerability is described as allowing local escalation of privileges to System level, with no user interaction required. Reported patch: ALPS07363632 (Issue ALPS07363632). Conne...

CVE-2023-33879

CVE-2023-33879 concerns a missing permission check in the music service leading to local information disclosure. Connected sources corroborate this as a privilege-check omission rather than remote execution. The CVE is associated with UNISOC chipsets (e.g., SC9863A, SC9832E, SC7731E, and others l...

CVE-2023-33917

CVE-2023-33917 : Multiple sources describe a vulnerability in vowifiservice due to a possible missing permission check, leading to local information disclosure with no additional execution privileges. The impact is described as information disclosure, with a local attack vector and low attack com...

CVE-2023-42652

CVE-2023-42652 affects the UNISOC/engineermode context. The root cause is a missing permission check in engineermode, enabling local information disclosure with no additional execution privileges. Impact aligns with the CVSS note: local attacker access to confidential data; exploitation status no...

CVE-2023-42683

CVE-2023-42683 affects the gsp driver in UNISOC chipsets, caused by a missing bounds check that enables an out-of-bounds read. The consequence stated in sources is local denial of service with SYSTEM-level privileges required. Connected documents corroborate the issue in the gsp driver across mul...

CVE-2023-42686

Technical details about CVE-2023-42686 are not publicly available in the provided connected documents. Monitor for updates for affected products, components, and remediation specifics.

CVE-2023-42698

CVE-2023-42698 affects the omacp service. A missing permission check could allow a local attacker to write an app’s permission usage records, causing local information disclosure (C: high). CVSSv3.1: 5.5 (MEDIUM), AV:L/AC:L/PR:L/UI:N/S:U. Exploitation details or affected product/version specifics...

CVE-2023-42704

CVE-2023-42704 affects imsservice in certain UNISOC-based environments. The root cause is a missing permission check that can allow an app to write permission usage records, enabling local information disclosure without requiring additional execution privileges. Reported impact aligns with NVD CV...

CVE-2023-42708

CVE-2023-42708 affects the firewall service, where a missing permission check could allow writing an app’s permission usage records, leading to local information disclosure without extra execution privileges. The issue is documented across multiple sources (NVD/Red Hat/PRion/CVE lists) and is ass...

CVE-2023-42712

Consolidated data for CVE-2023-42712 from multiple sources confirms a vulnerability in the firewall service of UNISOC chipsets. The root cause is a missing permission check that could allow an app to write permission usage records, enabling local information disclosure without requiring additiona...

CVE-2023-42715

CVE-2023-42715 affects UNISOC chipsets with a vulnerability in the telephony service caused by a missing permission check, enabling local information disclosure without requiring extra execution privileges. The CVSS entry cites local attack vector, low attack complexity, and low privileges requir...

CVE-2023-42721

The CVE-2023-42721 entry concerns the flv extractor component, where missing input validation is the reported root cause. This vulnerability could allow local denial of service without requiring user interaction or additional privileges, as described in multiple connected records (notably the Red...

CVE-2023-42730

CVE-2023-42730 describes a vulnerability in the IMS service where a missing permission check allows writing permission usage records, enabling local information disclosure without extra privileges. The NVD entry lists a CVSS 3.1 base score of 5.5 (Medium) with Local attack vector, Low attack comp...

CVE-2023-42731

CVE-2023-42731 affects the Gnss service in UNISOC chipsets. The vulnerability is an out-of-bounds read caused by a missing bounds check, leading to local denial of service with System execution privileges required. The CVSSv3.1 base score is 4.4 (Medium) with LOCAL attack vector, low attack compl...

CVE-2023-42738

CVE-2023-42738 involves the telocom service with a missing permission check that could allow local escalation of privilege. The NVD/Red Hat/PT-Security records describe a local-privilege escalation without requiring additional execution privileges. No concrete patch/version details are provided i...

CVE-2023-42748

CVE-2023-42748 refers to a missing permission check in the telecom service that can enable local privilege escalation without additional execution privileges. The vulnerability is characterized by local access (attack vector LOCAL), low privilege required, and no user interaction, with high confi...

CVE-2025-0076

Google Android CVE-2025-0076 describes an information-disclosure flaw where a missing permission check could allow viewing icons belonging to another user. Exploitation requires local access with no user interaction, aligning with the CVSS local access and low impact (C:L, I:N, A:N). Connected so...

CVE-2025-20781

The CVE-2025-20781 issue affects MediaTek chipsets’ display component, caused by a memory corruption due to use-after-free. This leads to local escalation of privilege if an attacker already has System privileges; exploitation does not require user interaction. A patch is listed as ALPS10182914 (...

CVE-2025-32313

CVE-2025-32313 relates to UsageEvents.java in Android, where an incorrect bounds check can cause an out-of-bounds write. This enables local privilege escalation with no additional execution privileges and no user interaction required. Affected software is described as UsageEvents (class/file) wit...

CVE-2025-32324

The CVE-2025-32324 entry concerns the Android ActivityManagerShellCommand.java onCommand path, where a confused deputy could allow arbitrary activity launches and lead to local privilege escalation. The underlying issue enables exploitation with no extra execution privileges and without user inte...

CVE-2025-36897

CVE-2025-36897 involves an out-of-bounds write in cd_CnMsgCodecUserApi.cpp due to a missing bounds check, enabling remote code execution without extra privileges and without user interaction. Public sources (Pixel bulletin) classify the issue as RCE with High severity and note a 2025-09-05 patch ...

CVE-2025-36928

CVE-2025-36928 : The issue is a potential out-of-bounds write in GetHostAddress of gxp_buffer.h caused by an incorrect bounds check. This can enable local escalation of privilege with no extra execution privileges required and no user interaction needed. Affected reports appear in multiple feeds ...

CVE-2025-48522

CVE-2025-48522 is an elevation-of-privilege vulnerability in Android, caused by a logic error in the setDisplayName function of AssociationRequest.java that can allow an app to retain the CDM association. This can lead to local EoP with no additional execution privileges and requires no user inte...

CVE-2025-48529

The CVE-2025-48529 issue affects VoicemailNotificationSettingsUtil.java, specifically the setRingtoneUri function, causing a cross-user data leak (confused deputy) that can disclose local information without extra privileges. Exploitation requires no user interaction and is local. The connected d...

CVE-2025-48541

CVE-2025-48541 : In the Android code path, the bug occurs in the onCreate of FaceSettings.java, where improper input validation can remove biometric unlock across user profiles. This enables local escalation of privilege with no additional execution privileges required, and exploitation does not ...

CVE-2025-48551

CVE-2025-48551 involves an information-disclosure flaw in Android where an image can leak across the User isolation boundary due to a confused deputy. The vulnerability is local (AV:L/AC:L/PR:L/UI:R), requires user interaction, and could expose confidential data (C:H/I:N/A:N) without executing co...

CVE-2025-48567

CVE-2025-48567 involves a bypass of a file path filter intended to restrict access to sensitive directories, caused by incorrect Unicode normalization. This can enable local escalation of privilege; exploitation requires user interaction. The CVE is referenced across multiple sources (NVD, Red Ha...

CVE-2026-0037

CVE-2026-0037 corresponds to a memory corruption issue in multiple functions of ffa.c, caused by a logic error. The CVE affects Google Android components and is described as enabling local escalation of privilege with no extra execution privileges and no user interaction required. The impact is n...

CVE-2026-0157

Summary of findings (CVE-2026-0157): The available documents consistently describe an out-of-bounds read in RtcpHeader::decodeRtcpHeader, caused by a missing bounds check. This leads to remote information disclosure without requiring user interaction; exploitation can occur over the network. The ...

CVE-2026-20429

CVE-2026-20429 describes a local out-of-bounds read caused by a missing bounds check in the display path, potentially enabling local information disclosure when an attacker already has System privileges. All sources (NVD/Red Hat/OSV, etc.) consistently state: no user interaction is required and t...

CVE-2018-5847

CVE-2018-5847 describes a use-after-free condition arising from early/late retirement of rotation requests in CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Affected software is Android CAF kernel components; the underlying issue is a memory-managem...

CVE-2018-5851

CVE-2018-5851 is a Qualcomm WLAN buffer-overflow vulnerability affecting Android devices (Pixel/Nexus) due to HTT_T2H_MSG_TYPE_TX_COMPL_IND processing with an out-of-range num_msdus. The issue can allow arbitrary code execution or a DoS. Public details map this CVE to Qualcomm WLAN in the May 201...

CVE-2018-5888

CVE-2018-5888 affects Qualcomm bootloader components (Bootloader) with Elevation of Privilege (EoP) and Moderate severity. The CVE description references an out-of-bounds access while processing the system path in CAF Android MSM Linux kernel prior to the 2018-06-05 patch level; connected data al...

CVE-2019-2171

CVE-2019-2171 affects Android 10, specifically the libxaac library, due to uninitialized data leading to information disclosure. The issue allows an attacker to disclose information without extra execution privileges; exploitation requires user interaction. Documents confirm impact on Android-10 ...

CVE-2023-32863

CVE-2023-32863 describes a vulnerability in the display DRM where a missing bounds check can lead to an out-of-bounds read, enabling local escalation of privileges with System execution privileges needed. User interaction is not required. The CVE is mitigated by Patch ID ALPS07326314 (Issue ID AL...

CVE-2023-38439

CVE-2023-38439 concerns a vulnerability in vowifiservice characterized by a possible missing permission check, which could enable local information disclosure without requiring additional execution privileges. The connected documents consistently reference vowifiservice as the affected component ...

CVE-2023-38440

CVE-2023-38440 concerns a missing permission check in vowifiservice, enabling local information disclosure with no extra privileges. The observed impact is local disclosure; CVSS indicates local attack vector, low privileges required, low attack complexity, with high confidentiality impact. Publi...

CVE-2023-38455

The CVE-2023-38455 entry concerns a vulnerability in vowifiservice where a missing permission check could permit local privilege escalation (attack vector: LOCAL; privileges required: LOW; user interaction: NONE). The published NVD entry shows a CVSS v3.1 base score of 7.8 (HIGH) with impacts to ...

CVE-2023-38457

CVE-2023-38457 affects vowifiservice. The vulnerability is caused by a missing permission check in vowifiservice, allowing local denial of service with no extra execution privileges. CVSS metrics indicate local attack vector, low attack complexity, and low privileges required, with availability i...