CVE-2026-0132

CVE-2026-0132 concerns the Modem component. The connected documents describe a vulnerability where an out-of-bounds write occurs due to a heap buffer overflow, enabling remote code execution with no additional privileges and no user interaction required. The CVSS metrics indicate network attack v...

CVE-2026-0137

CVE-2026-0137 affects the EdgeTPU kernel driver. The root cause is a use-after-free in the function edgetpu_sync_fence_group_shutdown() within edgetpu-dmabuf.c, which can enable a local elevation of privilege. The impact is local escalation to System execution privileges, with no user interaction...

CVE-2026-0158

CVE-2026-0158 affects the Camera component and describes an information disclosure vulnerability caused by a missing permission check that can allow local access to photos without extra execution privileges. Impact is local information disclosure (C: Low, I: None, A: None) with a CVSS 3.1 base sc...

CVE-2026-0165

CVE-2026-0165 is described across multiple sources as a vulnerability in the RTCP packet decoder where several functions perform an out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no execution privileges gained. Exploitation requires user in...

CVE-2026-20443

CVE-2026-20443 involves a memory corruption vulnerability caused by a use-after-free in the display path of MediaTek chipsets. This can lead to local escalation of privilege if an attacker already has System-level privileges; exploitation does not require user interaction. The issue is tracked wi...

CVE-2026-28575

CVE-2026-28575 affects the Android framework in PackageInstaller.Session.transfer (frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java). The issue is described as a logic error causing memory exhaustion that can lead to a local denial of service without requiring...

CVE-2025-11131

The CVE-2025-11131 issue resides in the UNISOC nr modem. The root cause is improper input validation in the modem path, which can cause a system crash and allow remote denial of service without extra privileges. The vulnerability is network-exploitable and does not require user interaction. Publi...

CVE-2025-20767

CVE-2025-20767 affects MediaTek chipsets. The issue is an out-of-bounds write caused by an integer overflow in display handling, enabling local escalation of privilege if the attacker already has System-level privileges. Exploitation details are not provided in the documents; no user interaction ...

CVE-2025-20786

CVE-2025-20786: memory corruption via use-after-free in display code enables local escalation of privilege for actors with System privileges; no user interaction required. Patch ALPS10149882 (Issue MSV-4673) is referenced across sources (e.g., Red Hat, NVD, CVE lists). Exploitation status not pro...

CVE-2025-22420

CVE-2025-22420 is a local elevation-of-privilege vulnerability in the Android Framework that could allow leaking audio files across user profiles due to a confused deputy. Exploitation is described as requiring no user interaction and being locally executable. The Android security bulletin and Re...

CVE-2025-3012

CVE-2025-3012 is associated with Unisoc dpc modem. The connected documents consistently describe a null pointer dereference in the modem stack that can cause a system crash and remote denial of service without requiring user interaction or local privileges. Affected component: dpc modem (Unisoc)....

CVE-2025-36916

CVE-2025-36916 affects code path in PrepareWorkloadBuffers of gxp_main_actor.cc, where a race condition can cause a double fetch. This permits local escalation of privilege with no extra execution privileges and no user interaction needed; exploitation is local. Connected documents corroborate th...

CVE-2025-36925

CVE-2025-36925 affects WAVES_send_data_to_dsp in libaoc_waves.c, where a missing bounds check can cause an out-of-bounds write. This leads to local escalation of privilege with no additional execution privileges required, and no user interaction is needed for exploitation. The connected Red Hat a...

CVE-2025-48525

Summary: CVE-2025-48525 affects the Android Framework (DisassociationProcessor.java). It describes an input validation issue allowing an app to continue reading notifications when not associated to a companion device, enabling local elevation of privilege with no extra privileges and no user inte...

CVE-2025-48566

CVE-2025-48566 is reported in multiple sources (Android bulletin and Red Hat) as a local elevation-of-privilege vulnerability in Android Framework related to bypassing user profile boundaries via a forwarded Intent, caused by improper input validation. The issue affects Android Framework componen...

CVE-2025-48613

The CVE-2025-48613 entry describes a vulnerability in VBMeta where an attacker can modify and resign VBMeta using a test key, assuming the original image was signed with the same key. This could enable local privilege escalation with no additional privileges or user interaction. Connected sources...

CVE-2025-61612

CVE-2025-61612 concerns the ntr modem component (referred to as “nr modem” in the sources) and describes a crash caused by improper input validation that could enable remote denial of service with no privileges required. The available connected reports consistently list the affected software as n...

CVE-2025-61615

CVE-2025-61615 affects NR Modem. The vulnerability is due to improper input validation in NR Modem, which can trigger a system crash and lead to remote denial of service without needing privileges or user interaction. The available sources describe the impact as a denial of service with potential...

CVE-2025-71254

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-0113

CVE-2026-0113 describes an out-of-bounds write in ns_GetUserData within ns_SmscbUtilities.c that could enable remote escalation of privilege without user interaction. Affected references across multiple feeds corroborate the same flaw and classify it as a high-severity issue with a common-criteri...

CVE-2026-0121

In VPU, a race condition enables a use-after-free read, causing local information disclosure without requiring privileges or user interaction. The issue is documented across multiple sources (NVD/Red Hat/OSV/ENISA/Android Pixel bulletin), with no publicly provided technical details on affected ve...

CVE-2026-0154

CVE-2026-0154 affects the Modem component and describes a memory corruption issue triggered by a SIP REFER request that could enable remote code execution with no additional privileges and without user interaction. The connected documents consistently state this is a Modem/SIP REFER memory corrup...

CVE-2026-20416

The CVE-2026-20416 entry concerns an out-of-bounds write in pcie caused by a missing bounds check, enabling local privilege escalation to System level without user interaction. Affected scope includes MediaTek-based PCIe components (as reflected across NVD/Red Hat OSV, CVE lists, and PT-security ...

CVE-2026-20417

CVE-2026-20417 concerns the PCIe subsystem where a missing bounds check enables an out-of-bounds write, potentially allowing local escalation of privilege if the attacker already has System privileges. Exploitation is described as local with no user interaction required; CVSS v3.1 vector shows lo...

CVE-2026-20428

CVE-2026-20428 describes a local out-of-bounds write caused by a missing bounds check in display logic, enabling local privilege escalation to SYSTEM without user interaction. The issue is documented with a patch identifier ALPS10320471 (Issue MSV-5536). Connected sources corroborate the same des...

CVE-2026-20441

CVE-2026-20441 affects MediaTek MAE and describes a possible out-of-bounds write caused by a missing bounds check, potentially enabling local privilege escalation without user interaction once System privileges are obtained. The vulnerability details are consistently reported across multiple sour...

CVE-2025-20764

CVE-2025-20764 affects the MediaTek “smi” component, where a missing bounds check allows an out-of-bounds write. This can enable local escalation of privilege for an attacker who already has System privileges, with no user interaction required. The issue is associated with patch ALPS10259774 (Iss...

CVE-2025-20773

The CVE-2025-20773 entry describes a memory corruption via use-after-free in the MediaTek chipsets display path, enabling local escalation of privilege for an attacker already with System privileges. No user interaction is required. The vulnerability impact is described as high for confidentialit...

CVE-2025-20777

The CVE-2025-20777 entry describes a local privilege escalation on MediaTek chipsets via an out-of-bounds write caused by a missing bounds check in display handling. This could allow a user with System privileges to elevate to higher privileges without user interaction. Patch ALPS10184870 (MSV-47...

CVE-2025-20783

CVE-2025-20783 describes an out-of-bounds write due to a missing bounds check in display code, potentially enabling local privilege escalation to SYSTEM without user interaction. The vulnerability is associated with MediaTek chipsets, with references noting Patch ID ALPS10182882 and Issue MSV-468...

CVE-2025-36912

CVE-2025-36912: DoS in the cellular modem due to a logic error; network-triggered, no user interaction required, with availability impact. Affected: cellular modem components in Google Pixel Android devices as documented in the Pixel December 2025 bulletin and corroborated by Red Hat/NVD/USD feed...

CVE-2025-36938

CVE-2025-36938 concerns a fault injection vulnerability in U-Boot function append_uint32_le() caused by a logic error in the code. The issue enables physical elevation of privilege with no additional execution privileges required and no user interaction needed. Multiple sources (NVD/Red Hat/OSVed...

CVE-2025-48590

CVE-2025-48590 affects the Android Framework component AppOpsService (verifyAndGetBypass). The issue describes a resource-exhaustion path that could allow a malicious local app to prevent dialing emergency services, causing local DoS without extra privileges or user interaction. Impact is limited...

CVE-2025-48596

CVE-2025-48596 is an Android/local privilege-escalation flaw caused by an out-of-bounds read in Parcel.cpp:appendFrom due to a missing bounds check. The issue allows local escalation without extra privileges or user interaction. Public references and Red Hat/EUVD/NVD entries describe the same aff...

CVE-2025-48614

CVE-2025-48614 : Android recovery path bug in rebootWipeUserData (RecoverySystem.java) allows factory reset while in DSU mode due to a missing permission check. This creates a physical denial-of-service risk with no extra privileges and no user interaction needed. Affected: Android framework comp...

CVE-2025-48636

The CVE-2025-48636 entry concerns a path traversal vulnerability in openFile of BugreportContentProvider.java that could allow reading and writing unauthorized files, enabling local privilege escalation without extra execution privileges or user interaction. The issue affects the described openFi...

CVE-2025-61607

CVE-2025-61607 affects Unisoc nr modem (Modem component). Root cause: improper input validation causing a system crash, enabling remote denial of service with no privileges required (CVSSv3.1: 7.5, Network, No user interaction). Affected platform notes from multiple sources reference Android patc...

CVE-2025-71253

CVE-2025-71253 concerns Modem IMS with an input validation flaw that can allow remote denial of service without extra privileges. The issue is described as improper input validation in Modem IMS, leading to availability impact (high) per CVSS vector: Network access, no user interaction, low attac...

CVE-2026-0111

CVE-2026-0111 affects the function ns_GetUserData in ns_SmscbUtilities.c, where an incorrect bounds check can cause an out-of-bounds write. This vulnerability could enable remote escalation of privilege without user interaction. Connected documents (Red Hat CVE entry, NVD/NVD-based summaries, EUV...

CVE-2026-0114

CVE-2026-0114 affects the Modem component, with an out-of-bounds write caused by an incorrect bounds check that could lead to remote code execution without user interaction or privileges. The description across Red Hat, NVD, EUVD, Android Pixel bulletin, and OSV entries consistently references th...

CVE-2026-0117

CVE-2026-0117 affects the MFC decoder path in mfc_dec_v4l2.c, where an incorrect bounds check enables an out-of-bounds write. This could lead to local escalation of privileges with no extra execution privileges required and no user interaction needed. The vulnerability is documented across multip...

CVE-2026-0128

CVE-2026-0128 affects code in RtcpFbPacket::decodeRtcpFbPacket, where an integer overflow can trigger an out-of-bounds read. This could lead to remote information disclosure without extra privileges. Exploitation requires user interaction. The connected documents consistently describe the same is...

CVE-2026-0129

The CVE-2026-0129 entry concerns RtcpByePacket::decodeByePacket with a missing bounds check that can lead to remote information disclosure. The available sources (NVD, OSV, PT security, Android Pixel bulletin) indicate this is related to libpixelimsmedia and triggers information disclosure withou...

CVE-2026-0133

Affected component: arm-smmu-v3.c (smmu_attach_dev). The issue is a missing permission check that can allow signing malicious Android Runtime bootclass artifacts, enabling local escalation of privilege without extra execution privileges. Exploitation requires local access; user interaction is not...

CVE-2026-0153

CVE-2026-0153: Out-of-bounds write in Write of msg_to_host_buffer.cc due to an incorrect bounds check; could enable local escalation of privilege with no user interaction. Pixel bulletin lists EdgeTPU as the affected subcomponent; initial materials do not publish a patch version or mitigation ste...

CVE-2026-20410

In imgsys, a vulnerability CVE-2026-20410 is described as an out-of-bounds write caused by a missing bounds check in a component of imgsys. The impact is local escalation of privilege to System with confidentiality, integrity, and availability impact rated high in the CVSS vector (LOCAL, HIGH imp...

CVE-2026-28587

CVE-2026-28587 affects the MmsSmsProvider component (MmsSmsProvider.java), enabling local information disclosure via a missing permission check. Exploitation requires no user interaction and does not require additional privileges; impact is confined to information disclosure. The vulnerability is...

CVE-2026-28615

CVE-2026-28615 affects Telecomm and is described as a permissions bypass that could allow initiating an unauthorized phone call, leading to local elevation of privilege without any additional execution privileges or user interaction. Technical details across sources confirm the vulnerability is l...

CVE-2025-20774

CVE-2025-20774 describes an out-of-bounds write due to a missing bounds check in the display path, potentially enabling local privilege escalation if the attacker already has System privileges. Exploitation reportedly does not require user interaction. Multiple sources (Red Hat, NVD, CVE listing,...

CVE-2025-36929

CVE-2025-36929 affects gxp_fence_manager.cc AreFencesRegistered. The issue is an information leak caused by improper input validation, enabling local information disclosure without extra privileges and without user interaction. Public exploitation details are not provided in the documents. The An...