CVE-2021-0690

CVE-2021-0690 is an Android vulnerability describing an out-of-bounds write (heap buffer overflow) in ih264d_parse_pslice.c that could cause remote information disclosure without extra privileges. Affected Android versions include 8.1, 9, 10, and 11. The issue is exploitable via network-like cond...

CVE-2021-0934

Summary: CVE-2021-0934 is a DoS in Android: in the function findAllDeAccounts of AccountsDb.java, causing resource exhaustion and local denial of service without extra privileges or user interaction. Affected products/versions include Android 10–13. The vulnerability’s impact is DoS; no exploit d...

CVE-2021-39629

CVE-2021-39629 is a race condition in phTmlNfc_Init/phTmlNfc_CleanUp that can cause a use-after-free, enabling local elevation of privilege without extra execution privileges or user interaction. Affected product: Android devices using phTmlNfc (component phTmlNfc.cc). Reported impact in the init...

CVE-2022-20110

CVE-2022-20110 affects the MediaTek ion component, where a race-condition triggers a use-after-free, enabling local elevation of privilege with no user interaction. Patch ALPS06399915/ALPS06399901 is referenced; Android bulletin materials indicate related SPL updates. Exploit code/details are not...

CVE-2022-20166

CVE-2022-20166 refers to a heap-based out-of-bounds write in multiple Android kernel base drivers that can enable local privilege escalation to SYSTEM. The issue requires no user interaction to exploit and is exploited via heap buffer overflow in kernel base drivers, granting local code execution...

CVE-2022-20426

CVE-2022-20426 affects Android 10–13, with a DoS condition caused by resource exhaustion in multiple functions across many files that can block a user from selecting a phone account. The impact is local denial of service with no privileges or user interaction required. The vulnerability is docume...

CVE-2022-20470

CVE-2022-20470 affects Android where bindRemoteViewsService in AppWidgetServiceImpl.java can bypass background activity launch due to improper input validation, enabling local elevation of privilege without extra privileges. Affected: Android 10–13 (per README). Connected documents corroborate th...

CVE-2023-21245

CVE-2023-21245 affects Google's Android Framework, specifically the showNextSecurityScreenOrFinish path in KeyguardSecurityContainerController.java. A logic error could allow access to the lock screen during device setup, enabling local elevation of privilege without user interaction. Exploitatio...

CVE-2024-23712

CVE-2024-23712 affects Android’s AppOpsService.java. It describes a potential DoS by saturating /data/system/appops_accesses.xml due to resource exhaustion. Exploitation is local with no privileges and no user interaction required. Android bulletin context indicates fixes in patch levels 2024-04-...

CVE-2024-31331

CVE-2024-31331 affects the Android Framework, specifically a logic error in PackageManagerService.java setMimeGroup that can hide the service from Settings. This can enable local elevation of privilege with high impact (confidentiality/integrity/availability). Exploitation requires local access a...

CVE-2019-1987

CVE-2019-1987 affects Google Android Framework components (notably a flaw in SkSwizzler.cpp) where a missing bounds check allows an out-of-bounds write, enabling remote code execution in a privileged context. Impact is described as high/severe, requiring user interaction for exploitation, with af...

CVE-2019-2103

CVE-2019-2103 affects Android 9 Framework. It describes a permissions bypass that could allow the Google Assistant to screenshot FLAG_SECURE apps, leading to local information disclosure without user interaction. The Android Security Bulletin lists CVE-2019-2103 under Framework with Type ID and H...

CVE-2020-0071

CVE-2020-0071 affects Android System component on Android 8.0–10. The vulnerability occurs in rw_t2t_extract_default_locks_info (rw_t2t_ndef.cc), where a missing bounds check can cause an out-of-bounds write, enabling remote code execution over NFC without user interaction. Affected products/vers...

CVE-2020-0079

CVE-2020-0079 affects the Android Media framework (Android 9 and 10). The vulnerability is a local elevation of privilege in CryptoPlugin.cpp, via an out-of-bounds write caused by a stale pointer in the decrypt_1_2 path. Exploitation requires local access (no user interaction) and could allow a p...

CVE-2021-0516

CVE-2021-0516 affects Android (versions 8.1, 9, 10 and 11) and is caused by a use-after-free in p2p_pd.c (p2p_process_prov_disc_req) leading to an out-of-bounds read/write. The vulnerability can enable remote elevation of privilege with no additional execution privileges and without user interact...

CVE-2021-0640

CVE-2021-0640 affects Android devices; in the StatsdStats.cpp file, the function noteAtomLogged contains a missing bounds check leading to an out-of-bounds write. This could allow local elevation of privilege without user interaction. Affected products/versions: Android 10, Android 11, Android 9....

CVE-2022-20117

Mode C: CVE-2022-20117 affects Pixel devices with Titan M (per Pixel Update Bulletin). The Titan M ID vulnerability indicates an information-disclosure issue where local data encrypted by the GSC can be decrypted due to improper crypto usage. Impact is local information disclosure without extra e...

CVE-2022-20349

CVE-2022-20349 affects Android 10–12(12L) and concerns the WifiScanningPreferenceController and BluetoothScanningPreferenceController. The issue is a possible admin restriction bypass caused by a missing permission check, enabling local elevation of privilege with no additional execution privileg...

CVE-2022-20398

CVE-2022-20398 affects Android 13 via addOrUpdateNetwork in WifiServiceImpl.java. A permissions bypass could let a guest user configure Wi‑Fi, enabling local escalation of privilege with User execution privileges needed and no user interaction required. CVSS: LOCAL, HIGH impact (C/H/I/A). Exploit...

CVE-2022-20568

CVE-2022-20568 describes a use-after-free in the Android kernel that could corrupt kernel memory and enable local escalation of privileges without user interaction; exploitation is reported as local, with no additional privileges or interaction required. The connected security bulletins (EulerOS/...

CVE-2023-20910

CVE-2023-20910 is an Android vulnerability in the WifiNetworkSuggestionsManager (Wifi) that allows a local DoS via resource exhaustion. Exploitation requires local access; no user interaction is needed. The issue is documented across multiple sources (NVD, OSV, Nessus/NCSC) with CVSSv3.1 metrics ...

CVE-2023-20948

CVE-2023-20948 affects Android (Android-12/12L/13) with a flaw in AAVCAssembler.cpp: in dropFramesUntilIframe there is a possible out-of-bounds read caused by a heap buffer overflow, leading to remote information disclosure without extra privileges or user interaction. Connections show no publish...

CVE-2023-21132

The CVE-2023-21132 issue originates in Android’s ManagePermissionsActivity.java onCreate, enabling local escalation of privilege when an attacker with physical device access can bypass factory reset protections due to a missing permission check. Affected component is the Android OS userland code ...

CVE-2023-21135

CVE-2023-21135 affects Google Android: the issue occurs in the onCreate path of NotificationAccessSettings.java, where improper input validation can cause a failure to persist notification settings. The underlying problem is an input validation defect in the code path that manages notification ac...

CVE-2024-31313

CVE-2024-31313 is an Android/MessageQueueBase.h issue involving an incorrect bounds check in the function availableToWriteBytes, which can cause an out-of-bounds write. The vulnerability enables local escalation of privilege with no additional execution privileges required and does not require us...

CVE-2025-20656

In CVE-2025-20656, the issue is in MediaTek DA within MediaTek firmware: a possible out-of-bounds write caused by a missing bounds check. This could enable local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed and no user in...

CVE-2020-0080

CVE-2020-0080: In Android 10 Framework, a flaw in AppOpsControllerImpl.java (onOpActiveChanged and related methods) could allow an app to display an overlay over other apps without the overlay notification icon, enabling local elevation of privilege with user interaction required. Affected compon...

CVE-2020-0380

CVE-2020-0380 affects Android: a flaw in allocExcessBits (bitalloc.c) allows a remote out-of-bounds write due to an incorrect bounds check, enabling potential remote code execution without user interaction. Impacted Android versions include 8.0, 8.1, 9, 10, and 11. The issue is categorized under ...

CVE-2021-0315

CVE-2021-0315 is an Android elevation-of-privilege issue described as a tapjacking/overlay-based flaw in GrantCredentialsPermissionActivity.java. Affected products/versions include Android 8.0, 8.1, 9, 10, and 11. The root cause is user interaction via a deceptive overlay, enabling local privileg...

CVE-2021-0396

CVE-2021-0396: In Android, a bounds-check bug in Builtins::Generate_ArgumentsAdaptorTrampoline (builtins-arm.cc and related files) allows an out-of-bounds write, potentially enabling remote code execution in an unprivileged process with no privileges required and no user interaction. Affected: An...

CVE-2021-0509

CVE-2021-0509 : A race condition causes a use-after-free in CryptoPlugin.cpp, leading to local privilege escalation with no additional privileges or user interaction required. Affected products/versions in the provided data include Android 8.1, 9, 10, and 11. The documents do not specify a public...

CVE-2022-20025

CVE-2022-20025 concerns a Bluetooth out-of-bounds write due to a missing bounds check, enabling local elevation of privilege without user interaction. The issue is associated with MediaTek/MALPS06126832 and is listed in Android/MobileRuntime advisories as affecting Bluetooth components (notably M...

CVE-2022-20082

CVE-2022-20082 : In MediaTek GPU software, a race condition can cause a use-after-free, enabling local elevation of privilege with no extra execution privileges or user interaction required. Multiple connected sources (including NVD and RH Red Hat advisories) confirm the issue as a GPU component ...

CVE-2022-20084

The CVE-2022-20084 entry affects MediaTek telephony, where a missing permission check could allow local privilege escalation to disable emergency broadcast reception. The issue is documented with a patch reference (ALPS06498874/ALPS06498874) and is associated with MediaTek’s devices, containing n...

CVE-2022-20125

Technical details about CVE-2022-20125 are not publicly available in the provided documents. Monitor for updates.

CVE-2022-20351

The CVE-2022-20351 issue affects Android via the CallLogProvider.java queryInternal path, where SQL injection could grant local access to voicemail information and cause information disclosure without extra privileges or user interaction. Multiple connected sources confirm the vulnerability is in...

CVE-2022-20445

CVE-2022-20445 affects Google Android (Android 10–13 per sources) and is tied to an out-of-bounds read in process_service_search_rsp within sdp_discovery.cc caused by improper input validation. Impact is information disclosure without additional execution privileges and no user interaction requir...

CVE-2022-20478

CVE-2022-20478 affects the Android NotificationChannel implementation (NotificationChannel.java) with a likely resource-exhaustion related failure to persist permissions, enabling local elevation of privilege without extra execution privileges. Affected products/versions include Android-10 throug...

CVE-2022-20491

CVE-2022-20491 affects Android devices via the NotificationChannel.java component. The issue is a resource exhaustion bug that can cause a failure to persist permission settings, enabling local elevation of privilege without user interaction. Affected: Android 10–13 (Android-10/11/12/12L/13). Imp...

CVE-2022-20495

CVE-2022-20495 affects Android 10–13 in Android’s AccessibilityManager.getEnabledAccessibilityServiceList due to a logic error that can hide an accessibility service, enabling local privilege escalation without extra privileges or user interaction. PT-Security documentation (PT-2022-14708) provid...

CVE-2022-20501

CVE-2022-20501 affects Android by described tapjacking/overlay in EnableAccountPreferenceActivity.onCreate, enabling a malicious phone account and potential local elevation of privilege. Affected: Android 10–13 (Android-10, -11, -12, -12L, -13). No exploit details provided in the supplied documen...

CVE-2022-20567

CVE-2022-20567 concerns the Linux kernel (also reflected in Android kernel contexts) where in the function pppol2tp_create of l2tp_ppp.c a race condition can cause a use-after-free. This vulnerability enables local escalation of privilege with kernel/system level impact and requires no user inter...

CVE-2023-20934

CVE-2023-20934 affects Android 12/12L/13. Root cause: in resolveAt attributionSource of ServiceUtilities.cpp, a permissions bypass could disable the microphone privacy indicator, enabling local elevation of privilege with no user interaction. Impact per sources is high (local, with confidentialit...

CVE-2023-20935

CVE-2023-20935 affects Android 11–13. It describes an out-of-bounds read caused by a missing bounds check during deserialization of multiple files, leading to local information disclosure without needing user interaction. Root cause: bounds-check omission in the deserialize path of the multiple f...

CVE-2023-21097

CVE-2023-21097 describes a local elevation of privilege in Android caused by a bug in toUriInner within Intent.java, allowing an attacker to launch an arbitrary activity. The vulnerability is classified as high severity (CVSS v3.1: LOCAL, LOW PRIVILEGES, UI:N, C:H/I:H/A:H) and affects Android 11,...

CVE-2023-21281

Summary (concrete details from connected docs): CVE-2023-21281 affects the Android Framework, specifically the KeyguardViewMediator.java logic, where a flaw can cause a failure to lock after screen timeout. This enables local elevation of privilege across users with no additional execution privil...

CVE-2024-0051

CVE-2024-0051 : The vulnerability is in onQueueFilled of SoftMPEG4.cpp, causing a possible out-of-bounds write due to a heap buffer overflow. The issue could lead to local elevation of privilege without requiring user interaction, as described across multiple sources (e.g., NVD/Red Hat CNVD/CVE l...

CVE-2025-27700

CVE-2025-27700 is an elevation-of-privilege issue described for Google Pixel devices. The vulnerability enables a local escalation of privilege via bypassing carrier restrictions with no extra execution privileges or user interaction required; exploitation is local. The NVD entry lists CVSSv3.1: ...

CVE-2015-3864

CVE-2015-3864 is a remote-code-execution vulnerability in Android’s mediaserver (libstagefright). It arises from an integer underflow when parsing the MPEG-4 tx3g chunk in the Stagefright parser, enabling crafted MPEG-4 data to corrupt memory. The issue is tied to an incomplete fix for CVE-2015-3...

CVE-2020-0068

CVE-2020-0068 affects the Android kernel audio driver (msm-cirrus-playback.c) via crus_afe_get_param, causing an out-of-bounds read due to an integer overflow. This can lead to local information disclosure with System privileges required; exploitation does not require user interaction. Documented...