CVE-2026-0126

In WC-Radio, there is a confirmed vulnerability causing an out-of-bounds write due to a missing bounds check. This can lead to remote code execution with no privileges and no user interaction required. The issue is detailed across multiple feeds (NVD entry CVE-2026-0126, EUVD-2026-, and related O...

CVE-2026-28615

CVE-2026-28615 affects Telecomm and is described as a permissions bypass that could allow initiating an unauthorized phone call, leading to local elevation of privilege without any additional execution privileges or user interaction. Technical details across sources confirm the vulnerability is l...

CVE-2018-11911

Affected software : Android releases (Android for MSM, Firefox OS for MSM, QRD Android) built with CAF Linux kernel. Root cause : improper configuration of a script, as described in CNVD-2018-25313. Impact : potential unprivileged access / privilege access control vulnerability. References in con...

CVE-2018-11913

Technical details for CVE-2018-11913 are not publicly provided in the connected documents. The available records reiterate a generic issue related to dev node configuration in CAF/Linux kernel builds. Monitor for updates from official advisories.

CVE-2023-38441

CVE-2023-38441 affects vowifiservice. The root cause is a missing permission check, which could allow local information disclosure without requiring additional privileges. The issue is characterized by LOCAL attack vector, LOW exploit complexity, and MEDIUM base score (C: HIGH confidentiality imp...

CVE-2023-38460

Summary of CVE-2023-38460 : Multiple connected sources identify a vulnerability in vowifiservice (linked to Unisoc chipsets) caused by a possible missing permission check. The underlying issue enables local privilege escalation with no additional execution privileges, with CVSS/metrics indicating...

CVE-2023-38466

The CVE-2023-38466 entry describes a vulnerability in the ims service of UNISOC chipsets where a missing permission check could allow local information disclosure without requiring additional privileges. The issue is documented across multiple feeds (NVD/Red Hat/CVE/CNNVD) with the same core desc...

CVE-2023-42675

CVE-2023-42675 affects imsservice (Unisoc-focused vulnerabilities). The issue arises from a missing permission check in imsservice, enabling an attacker to write permission usage records of an app and potentially disclose locally held information without additional execution privileges. Connected...

CVE-2023-42725

CVE-2023-42725 concerns the GPU driver with a missing bounds check that enables an out-of-bounds read and local denial of service with System execution privileges. This aligns across multiple sources (NVD, Red Hat, CVE lists) describing the same issue in the GPU driver; exploitation status is not...

CVE-2023-42729

CVE-2023-42729 affects the ril service (noted in multiple feeds, including NVD and downstream advisories). The vulnerability is caused by a missing bounds check, leading to an out-of-bounds write. This could enable a local denial of service and may allow system execution privileges to be leverage...

CVE-2023-42745

Technical details (affected product/component/versions/root cause) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2025-48609

CVE-2025-48609 involves a path traversal issue in MmsProvider.java across Google Android components that can allow arbitrary file deletion and impact telephony, SMS, and MMS features. The vulnerability can cause a local denial of service without extra privileges or user interaction, as reported b...

CVE-2025-48611

Summary of CVE-2025-48611 : The vulnerability is in the DeviceId.java code path (DeviceId class) where a missing bounds check can cause a desync in persistence, enabling local elevation of privilege without extra execution privileges or user interaction. This is consistently described across mult...

CVE-2025-48638

CVE-2025-48638 affects Google Android’s pKVM (protected Kernel-based Virtual Machine) in the kernel, specifically in __pkvm_load_tracing within trace.c. The flaw is an out-of-bounds write caused by improper input validation, enabling local escalation of privilege with no additional execution priv...

CVE-2025-61614

CVE-2025-61614 affects the nr modem. The issue is a system crash caused by improper input validation, leading to remote denial of service with no privileges required. CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields a base score of 7.5 (HIGH). Exploitation details are not provided in the doc...

CVE-2026-0011

CVE-2026-0011 is described across multiple sources as a logic error in enableSystemPackageLPw() within Settings.java that can prevent location access from functioning, enabling local privilege elevation without requiring additional execution privileges and without user interaction. This vulnerabi...

CVE-2026-0017

CVE-2026-0017 is tied to a logic error in BiometricService.java on the Android platform that could allow enabling fingerprint unlock and cause local elevation of privilege without additional execution privileges or user interaction. The vulnerability appears in the onChange path of BiometricServi...

CVE-2026-0050

Technical details are not publicly available in the provided documents for CVE-2026-0050. Monitor for updates from official advisories.

CVE-2026-0067

Technical details, affected products, and remediation are not publicly provided in the supplied documents. Monitor for updates from the listed sources; no concrete exploit or affected versions can be confirmed from the material available.

CVE-2026-0125

CVE-2026-0125 is a local elevation-of-privilege issue caused by a use-after-free in vpu_ioctl.c across multiple functions, triggered by a race condition. The vulnerability allows a local attacker to escalate privileges without additional execution privileges or user interaction, as described in s...

CVE-2023-38437

CVE-2023-38437 affects the vowifiservice component. The connected documents describe a missing permission check in vowifiservice that could cause local information disclosure without requiring additional execution privileges. The impact is stated as local information disclosure and the attack vec...

CVE-2023-38438

CVE-2023-38438 affects vowifiservice. The issue is a missing permission check in vowifiservice that can lead to local information disclosure without additional execution privileges. According to NVD metrics, the attack is local with low privileges required, and can disclose high-confidentiality d...

CVE-2023-42697

CVE-2023-42697 affects the omacp service. A missing permission check could allow writing an app’s permission usage records, leading to local information disclosure with no additional execution privileges. The connected documents provide the issue and impact but do not specify exploitation status ...

CVE-2023-42707

Summary of CVE-2023-42707 : A vulnerability in the firewall service of UNISOC chipsets (as described in multiple sources) arises from a missing permission check that can allow a local attacker to write records of an app’s permission usage, causing local information disclosure without extra execut...

CVE-2023-42743

CVE-2023-42743 involves a missing permission check in a telecom service, enabling local privilege escalation with no additional execution privileges needed. The connected sources indicate UNISOC chipsets are implicated, tying the issue to telecom functionality on those platforms. Documented impac...

CVE-2023-42746

CVE-2023-42746 is described as a local privilege-escalation due to a missing permission check in the power manager. The NVD entry notes local attack vector with low privileges required and no user interaction, and a high impact on confidentiality, integrity, and availability (CVSS 3.1 base score ...

CVE-2025-22415

CVE-2025-22415 affects Android Wear OS devices and is described as a local elevation-of-privilege in the android_app component of Android.bp, where there is a path to launch any activity as a system user without user interaction. The root cause is tied to the System component behavior in Wear OS/...

CVE-2025-32327

CVE-2025-32327 affects Google Android via SQL injection in multiple functions of PickerDbFacade.java, enabling unauthorized data access and local elevation of privilege with no user interaction. Impact and exploit details are stated in multiple sources (NVD, Red Hat, CNVD, OSV). Root cause is an ...

CVE-2025-32331

CVE-2025-32331 involves a logic error in showDismissibleKeyguard within KeyguardService.java that could allow bypassing app pinning, enabling local escalation of privilege without user interaction. The connected sources consistently describe a local-privilege-elevation scenario tied to KeyguardSe...

CVE-2025-36896

CVE-2025-36896 affects WLAN on Google Pixel devices running Android prior to the 2025-09-05 patch level. The issue is an elevation of privilege in the WLAN component; CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction required. The Pixel security bulletin groups th...

CVE-2025-48534

CVE-2025-48534 affects Android’s CellBroadcast handling code. In getDefaultCBRPackageName of CellBroadcastHandler.java, a logic error may allow privilege escalation, yielding local denial of service with System execution privileges and no user interaction required. Current connected sources confi...

CVE-2025-48560

CVE-2025-48560 describes a vulnerability in Android/Wear OS where an app could monitor motion events via AndroidManifest.xml due to a confused deputy, enabling local information disclosure without extra privileges or user interaction. Connected sources (Wear OS security bulletin and related advis...

CVE-2025-48597

CVE-2025-48597 is an Android Framework–level tapjacking/overlay vulnerability that could enable local privilege escalation without user interaction. Reported details indicate the issue affects Android Framework components and is addressed via Android security patches at patch levels 2025-12-01 / ...

CVE-2025-48607

Technical details about CVE-2025-48607 are not publicly available in the provided documents. Sources reiterate a local DoS due to a logic error but do not specify affected products/versions or remediation. Monitor for updates.

CVE-2025-48624

CVE-2025-48624 is a local privilege-escalation vulnerability in the Linux kernel's ARM SMMU v3 driver (arm-smmu-v3.c) caused by improper input validation, leading to an out-of-bounds write in multiple functions. The issue could allow local escalation with no extra privileges and does not require ...

CVE-2026-0083

Summary: CVE-2026-0083 describes a possible use-after-free in Nfc::eventCallback() within Nfc.h caused by a race condition, enabling local privilege escalation with no additional privileges and no user interaction required. Connected sources (NVD, EUVD, CIRCL, CVE lists) reproduce the same descri...

CVE-2026-0130

CVE-2026-0130 is a heap buffer overflow in RtcpChunk::decodeRtcpChunk within the libpixelimsmedia component of Google Pixel devices, leading to an out-of-bounds read . The vulnerability allows remote information disclosure with no additional execution privileges required, though user interaction ...

CVE-2026-0134

CVE-2026-0134 is an information disclosure vulnerability in the Recovery component of Google Pixel devices. A logic error in the PostWipeData function of recovery_ui.cpp can cause data persistence after a factory reset , allowing local information disclosure without additional privileges or user ...

CVE-2026-28575

CVE-2026-28575 affects the Android framework in PackageInstaller.Session.transfer (frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java). The issue is described as a logic error causing memory exhaustion that can lead to a local denial of service without requiring...

CVE-2026-28578

CVE-2026-28578 describes a vulnerability in multiple functions of Android’s DevicePolicyManagerService.java where there is a desync from persistence caused by improper input validation. This can lead to a local denial of service without requiring additional privileges or user interaction. Documen...

CVE-2023-38452

Technical details (affected components, versions, exploit scenarios, patches) are not publicly provided in the connected documents. Monitor sources for updates.

CVE-2023-42680

The CVE-2023-42680 entry concerns a vulnerability in the GPU driver where a missing bounds check enables an out-of-bounds read, potentially causing local denial of service with SYSTEM privileges. The available documents consistently describe the issue as a GPU driver boundary-check failure and it...

CVE-2023-42688

The CVE-2023-42688 issue is described across connected sources as a missing permission check in the wifi service, enabling local privilege escalation with no extra privileges. This aligns with the Red Hat/NVD/CNNVD entries and the UNISOC/CNNVD narratives, showing a local-privilege-elevation impac...

CVE-2023-42700

CVE-2023-42700 affects the firewall service on Unisoc chipsets, where a missing permission check allows an app to write permission usage records, leading to local information disclosure. The NVD report assigns CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (base score 5.5). Exploitation status is...

CVE-2023-42703

The CVE-2023-42703 entry describes a vulnerability in the firewall service where a missing permission check allows writing permission usage records for an app, enabling local information disclosure without additional execution privileges. Affected context is the firewall service component; underl...

CVE-2025-20802

In geniezone, a memory corruption vulnerability exists due to a use-after-free condition that could lead to local elevation of privilege if an attacker already has System privileges. No user interaction is required. A patch is available: ALPS10238968 (MSV-4914). This CVE references multiple sourc...

CVE-2025-32347

CVE-2025-32347 affects the Android BiometricEnrollIntroduction.java onStart path, where an unsafe PendingIntent can disclose the device’s location, enabling local privilege elevation with no extra privileges. Exploitation requires user interaction. Root cause: unsafe PendingIntent leading to info...

CVE-2025-36905

CVE-2025-36905 describes a vulnerability in gxp_mapping_create within gxp_mapping.c, caused by a logic error that enables local privilege escalation with no additional privileges or user interaction required. Exploitation details are not provided in the connected documents. The Pixel bulletin ent...

CVE-2025-36930

CVE-2025-36930 involves a potential out-of-bounds write in GetHostAddress of gxp_buffer.h, caused by a missing bounds check. This can lead to local elevation of privilege with no extra execution privileges or user interaction required. Multiple feeds (NVD, Red Hat, ENISA, CVE lists, and Android P...

CVE-2025-48576

CVE-2025-48576 affects Android’s framework component NotificationManagerService.java, specifically the function updateNotificationChannelGroupFromPrivilegedListener. The issue is a possible permanent denial of service caused by resource exhaustion, leading to local DoS with no additional executio...