8205 matches found
CVE-2020-10844
CVE-2020-10844 is documented as an out-of-bounds read vulnerability in Samsung mobile devices’ media.audio_policy, affecting O(8.x), P(9.x), and Q(10.0) software. The Samsung internal ID is SVE-2019-16333. The connected Red Hat, CNVD, CNVD-style entries repeat the same description; no product-spe...
CVE-2026-0060
Technical details about CVE-2026-0060 are not publicly available in the provided documents. No affected products, vectors, or mitigations are specified here. Monitor for updates as new information becomes available.
CVE-2026-0088
The CVE-2026-0088 affects Android’s CertInstaller.getCallingAppLabel, where a misleading or insufficient UI could allow hiding a sensitive security dialogue. This enables local privilege escalation with no extra privileges and no user interaction required for exploitation, as described across NVD...
CVE-2026-0138
The CVE-2026-0138 issue affects the function lwis_io_buffer_write in lwis_io_buffer.c, described across multiple sources (NVD, ENISA EUVD, CVE listings, OSV) as a possible out-of-bounds write caused by memory corruption. Impact is local elevation of privilege requiring system execution privileges...
CVE-2026-0141
CVE-2026-0141 describes a likely out-of-bounds read in decodeAppPacket of RtcpAppPacket.cpp caused by a missing bounds check. The vulnerability enables a remote information disclosure without requiring additional execution privileges and without user interaction. Public references in the provided...
CVE-2026-0156
CVE-2026-0156 describes a memory safety issue in checkSsrcCollisionOnRcv of RtpSession.cpp caused by a missing null check. This could allow remote denial of service without additional execution privileges, and exploitation does not require user interaction. The information appears consistently in...
CVE-2026-28600
CVE-2026-28600 is a confused deputy vulnerability in the Android payment framework , specifically in the onCreate method of PaymentDefaultDialog.java. An attacker can change the device's default payment app without additional execution privileges or user interaction, enabling a local escalation o...
CVE-2014-9958
CVE-2014-9958 is an elevation of privilege in Qualcomm closed‑source components within Android kernel. The vulnerability affects Qualcomm components integrated in Android devices and is listed in the Android security bulletin with fixes provided by Qualcomm AMSS and Android patch updates (June 20...
CVE-2016-3803
CVE-2016-3803 affects the Android kernel file system. The vulnerability is an elevation of privilege in the kernel file system on Nexus 5X and Nexus 6P, caused by a flaw in the kernel file system implementation that allows a locally installed malicious app to gain higher privileges. Connected doc...
CVE-2018-11827
CVE-2018-11827 affects CAF/Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. The issue: improper validation of an array index in the WMA roam synchronization handler can cause an out-of-bounds write. This is tied to Qualcomm WLAN/driver components in the af...
CVE-2018-11908
Technical details (affected products, components, root cause, exploits, or fixes) are not publicly provided in the connected documents; monitor for updates.
CVE-2018-11909
CVE-2018-11909 describes an improper access-control issue in CAF-based Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel, where a device node/executable could be run from /cache/. The connected records do not provide concrete technical details about the vuln...
CVE-2018-9580
CVE-2018-9580 is an Elevation of Privilege in the HTC bootloader affecting Android kernel components. The issue is categorized as EoP with high risk (CVSS v3.0 base score 9.8) and high impact on confidentiality, integrity, and availability; exploitation details or vectors are not disclosed in the...
CVE-2019-2158
CVE-2019-2158 affects Android-10 in the libxaac library, with an out-of-bounds read caused by a missing bounds check. This can lead to an information disclosure and requires user interaction to exploit. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, PRION, CVE List) ...
CVE-2019-2168
CVE-2019-2168 affects the libxaac library in Android 10. The issue is information disclosure caused by uninitialized data, requiring user interaction to exploit. The vulnerability manifests as partial confidentiality impact with no integrity/availability impact stated, and a network attack vector...
CVE-2019-9264
CVE-2019-9264 affects Android 10 where the libxaac library contains a missing-bounds-check flaw that enables an information-disclosure via an out-of-bounds read. This issue requires user interaction for exploitation and could disclose partial data without executing code. The root cause is an out-...
CVE-2019-9317
CVE-2019-9317 affects Android 10’s libstagefright, where a missing variable initialization could allow remote information disclosure. Root cause is an uninitialized variable in libstagefright, enabling information leakage without additional privileges; exploitation requires user interaction per t...
CVE-2019-9327
CVE-2019-9327 affects the Android 10 Bluetooth stack. Root cause: missing bounds check causing an out-of-bounds read, enabling remote information disclosure with no privileges and no user interaction over a network. Exploitation status is not detailed in the provided documents. Remediation accord...
CVE-2019-9347
CVE-2019-9347 affects Android 10 via the m4v_h263 codec. The vulnerability is an out-of-bounds read caused by a use-after-free, leading to local information disclosure without requiring user interaction. Documentation across sources confirms the issue in the Media framework; exploitation details ...
CVE-2019-9389
CVE-2019-9389 affects Android 10 Bluetooth stack (Bluetooth component) with a out-of-bounds read due to a missing bounds check. This could lead to remote denial of service without user interaction. CVSSv2 base score 5.0 (NETWORK, LOW attack complexity, no privileges required, Availability impact ...
CVE-2020-0208
CVE-2020-0208 affects Android Framework, specifically in multiple functions of AccountManager.java, where a permissions bypass could enable local privilege escalation with no additional execution privileges needed and without user interaction. The vulnerability is reflected in multiple sources: N...
CVE-2020-0244
CVE-2020-0244 affects Android 11, describing an out-of-bounds read in SPDIFEncoder.cpp (writeBurstBufferBytes) caused by an incorrect bounds check. This can lead to local information disclosure without a clear exfiltration path; exploitation requires user interaction. The NVD entry lists CVSS det...
CVE-2022-48439
The CVE-2022-48439 entry concerns the cp_dump driver, where a missing bounds check enables an out-of-bounds write. This can lead to a local denial of service with SYSTEM-level execution privileges required. Public sources confirm the impact includes availability risk, with confidentiality/integri...
CVE-2023-20748
CVE-2023-20748 affects Mediatek-related chips with a vulnerability in the display path causing an out-of-bounds read due to a missing bounds check. Impact cited as local information disclosure with system-level privileges needed; exploitation reportedly does not require user interaction. Patch ID...
CVE-2023-20774
CVE-2023-20774 involves an out-of-bounds read in the display path due to a missing bounds check, enabling local privilege escalation with System execution privileges required and no user interaction. Multiple connected sources (MediaTek-related advisories and vendor feeds) confirm the issue affec...
CVE-2023-21232
CVE-2023-21232 corresponds to a permissions-bypass information-disclosure issue affecting Wear OS and related Android components. The vulnerability allows retrieval of sensor data without permission, with local access and no user interaction required. Exploitation details (vector, affected versio...
CVE-2023-30927
Summary : CVE-2023-30927 is a local information disclosure vulnerability due to a missing permission check in the telephony service. The NVD entry reports a CVSSv3.1 base score of 5.5 (LOW privileges required, LOCAL exploit, HIGH confidentiality impact). Connected sources corroborate the issue an...
CVE-2023-30931
CVE-2023-30931 involves a missing permission check in the telephony service that could allow local information disclosure without additional execution privileges. The issue is described across multiple sources as affecting UNISOC chipsets (telephony component), with attack vector LOCAL, attack co...
CVE-2023-32856
CVE-2023-32856 concerns MediaTek chipsets where the display module has an out-of-bounds read caused by an incorrect status check. The vulnerability can lead to local information disclosure with System execution privileges required, and exploitation does not require user interaction. The available...
CVE-2023-38440
CVE-2023-38440 concerns a missing permission check in vowifiservice, enabling local information disclosure with no extra privileges. The observed impact is local disclosure; CVSS indicates local attack vector, low privileges required, low attack complexity, with high confidentiality impact. Publi...
CVE-2023-38443
CVE-2023-38443 affects vowifiservice. The root cause is a missing permission check, enabling local privilege escalation without additional execution privileges. CVSSv3.1 vectors indicate Local access, Low attack complexity, Low privileges required, with High impact on confidentiality, integrity, ...
CVE-2023-38453
Technical details about CVE-2023-38453 are not publicly provided in the supplied documents. Monitor for updates.
CVE-2023-38456
CVE-2023-38456 affects vowifiservice with a missing permission check that can lead to local privilege escalation (no extra execution privileges required). This is described across multiple sources as a local escalation vulnerability with a base CVSS v3.1 score of 7.8 (HIGH) and LOCAL attack vecto...
CVE-2023-38467
CVE-2023-38467 affects the urild service and is caused by a missing bounds check that enables an out-of-bounds write. This can lead to a local denial of service with SYSTEM privileges required. Reported CVSSv3.1 vector (L/L/H/N/U) indicates local access, low complexity, high privileges required, ...
CVE-2023-42687
CVE-2023-42687 : The wifi service contains a missing permission check that could enable local escalation of privilege with no additional execution privileges required. The available data from the CVE entry indicates a local exploit path with a high impact (Confidentiality/Integrity/Availability H...
CVE-2023-42702
CVE-2023-42702 describes a missing permission check in the firewall service that allows an attacker with local access to write permission usage records for an app, causing local information disclosure with no additional execution privileges. Affected: firewall service in UNISOC chipsets. Impact: ...
CVE-2023-42711
The CVE-2023-42711 entry concerns a vulnerability in the firewall service where a missing permission check allows an app to write permission usage records, causing local information disclosure with no extra execution privileges required. Affected component: firewall service (general description a...
CVE-2023-42717
CVE-2023-42717 affects the telephony service where a missing permission check could allow remote information disclosure without additional privileges. The CVSS data indicates network attack vector, low complexity, no user interaction, with a high confidentiality impact (C:H, I:N, A:N) and unchang...
CVE-2024-40664
CVE-2024-40664 describes a logic error in setupAccessibilityServices within AccessibilityFragment.java that may allow hiding an enabled accessibility service, potentially causing local denial of service without extra privileges or user interaction. The vulnerability is documented across multiple ...
CVE-2025-0076
Google Android CVE-2025-0076 describes an information-disclosure flaw where a missing permission check could allow viewing icons belonging to another user. Exploitation requires local access with no user interaction, aligning with the CVSS local access and low impact (C:L, I:N, A:N). Connected so...
CVE-2025-20722
CVE-2025-20722 affects the gnss driver with an out-of-bounds read caused by an integer overflow. Exploitation would lead to local information disclosure if the attacker already has System privileges; no user interaction is required. A patch (ALPS09920036) is referenced (Issue MSV-3798).
CVE-2025-20795
CVE-2025-20795 describes an out-of-bounds write in the KeyInstall component caused by a missing bounds check, enabling local escalation to System privileges. Exploitation does not require user interaction per the description. Public records reference a patch: ALPS10276761 (MSV-5141). The CVSS met...
CVE-2025-48522
CVE-2025-48522 is an elevation-of-privilege vulnerability in Android, caused by a logic error in the setDisplayName function of AssociationRequest.java that can allow an app to retain the CDM association. This can lead to local EoP with no additional execution privileges and requires no user inte...
CVE-2025-48529
The CVE-2025-48529 issue affects VoicemailNotificationSettingsUtil.java, specifically the setRingtoneUri function, causing a cross-user data leak (confused deputy) that can disclose local information without extra privileges. Exploitation requires no user interaction and is local. The connected d...
CVE-2025-48542
CVE-2025-48542 is an Android vulnerability affecting AccountManagerService.java, causing a possible permanent denial of service due to resource exhaustion. Exploitation is local, requires no additional privileges, and does not require user interaction. Multiple connected sources corroborate the i...
CVE-2025-48555
The CVE-2025-48555 entry concerns a vulnerability in the Android code path involving NotificationStation.java, where cross-profile information disclosure can occur due to a confused deputy. The impact is local privilege escalation without requiring additional execution privileges or user interact...
CVE-2025-48559
CVE-2025-48559 affects Google Android’s AppOpsService.java. The vulnerability arises from improper input validation in multiple internal functions, enabling an attacker to add a large number of app ops. This can cause a local denial of service with no extra privileges and without user interaction...
CVE-2025-48610
CVE-2025-48610 stems from a logic error in mem_protect.c __pkvm_guest_relinquish_to_host, enabling a local information disclosure without required privileges or user interaction. Affected component: Android/Linux kernel KVM (pkvm) code path. Impact: potential leakage of configuration data. Exploi...
CVE-2025-48642
The CVE-2025-48642 issue is described as a logic error in the Android payload.rs file’s jump_to_payload function that enables local information disclosure without requiring user interaction. Documented impact is information disclosure with local access; confidentiality is affected while no integr...