CVE-2026-20427

CVE-2026-20427 represents a local privilege escalation caused by a missing bounds check in the display path. The issue could allow a malicious actor who has already obtained System privileges to elevate further without user interaction. The description does not specify affected products or compon...

CVE-2026-20428

CVE-2026-20428 describes a local out-of-bounds write caused by a missing bounds check in display logic, enabling local privilege escalation to SYSTEM without user interaction. The issue is documented with a patch identifier ALPS10320471 (Issue MSV-5536). Connected sources corroborate the same des...

CVE-2026-20442

CVE-2026-20442 affects MediaTek chipsets and is caused by a use-after-free in the display path, leading to a possible local crash and denial of service when the attacker already has System privileges. Exploitation does not require user interaction and is local (attack vector: local). The conditio...

CVE-2026-20443

CVE-2026-20443 involves a memory corruption vulnerability caused by a use-after-free in the display path of MediaTek chipsets. This can lead to local escalation of privilege if an attacker already has System-level privileges; exploitation does not require user interaction. The issue is tracked wi...

CVE-2025-20697

CVE-2025-20697 : In Power HAL (MediaTek), an out-of-bounds write caused by a missing bounds check could enable local escalation of privilege if the attacker already has System privileges. Exploitation requires no user interaction. A patch is available: ALPS09915681 (MSV-3795). Multiple feeds corr...

CVE-2025-20705

CVE-2025-20705 concerns a memory corruption issue (use-after-free) in the MediaTek Modem’s monitor_hang path that could enable local privilege escalation if an attacker already has System privileges. Exploitation is described as not requiring user interaction. The vulnerability is tied to a patch...

CVE-2025-20765

CVE-2025-20765 affects the MediaTek/MediaTek-derived environment where the race condition in the aee daemon can cause a system crash leading to local denial of service. Exploitation is described as possible without user interaction, but requires the attacker to already have System privileges. The...

CVE-2025-36925

CVE-2025-36925 affects WAVES_send_data_to_dsp in libaoc_waves.c, where a missing bounds check can cause an out-of-bounds write. This leads to local escalation of privilege with no additional execution privileges required, and no user interaction is needed for exploitation. The connected Red Hat a...

CVE-2025-36931

CVE-2025-36931: Out-of-bounds write in GetHostAddress of gxp_buffer.h allows local privilege escalation without user interaction. Documented in multiple sources (e.g., Android Pixel bulletin) as a local issue related to Pixel devices; patch guidance indicates updating to the December 2025 patch l...

CVE-2025-48604

Technical details for CVE-2025-48604 are not publicly provided in the connected documents. Monitoring for updates is advised as more specifics (affected products, versions, and fixes) may be released.

CVE-2025-48606

CVE-2025-48606 is a logic-error-based vulnerability in Android’s InstallPackageHelper.java (preparePackage) that can cause an app to appear hidden at install, without an uninstall mechanism, enabling local privilege escalation with no extra execution privileges and no user interaction. It is docu...

CVE-2025-48613

The CVE-2025-48613 entry describes a vulnerability in VBMeta where an attacker can modify and resign VBMeta using a test key, assuming the original image was signed with the same key. This could enable local privilege escalation with no additional privileges or user interaction. Connected sources...

CVE-2025-61607

CVE-2025-61607 affects Unisoc nr modem (Modem component). Root cause: improper input validation causing a system crash, enabling remote denial of service with no privileges required (CVSSv3.1: 7.5, Network, No user interaction). Affected platform notes from multiple sources reference Android patc...

CVE-2025-61618

CVE-2025-61618 affects Unisoc nr modem. The root cause is improper input validation in the modem stack, leading to a system crash and remote denial of service without requiring privileges or user interaction. The available documentation consistently describes this as a DoS via remote input handli...

CVE-2025-69279

CVE-2025-69279 concerns a vulnerability in the nr modem where improper input validation can cause a system crash, enabling remote denial of service without requiring privileges. Multiple sources (NVD, Red Hat, EUVD, CVE list, etc.) describe the issue consistently, identifying the affected compone...

CVE-2025-71252

Technical details are not publicly available in the provided documents. Monitor for updates from vendors (Modem IMS) for affected components, potential impact, and officially recommended remediation.

CVE-2026-0135

CVE-2026-0135 affects the Modem component, where a missing bounds check can enable an out-of-bounds read. This can lead to remote code execution with no additional privileges required and no user interaction. Several connected sources (NVD, EUVD-ENISA, CVE listings, OSV and PT-Security entries) c...

CVE-2026-0158

CVE-2026-0158 affects the Camera component and describes an information disclosure vulnerability caused by a missing permission check that can allow local access to photos without extra execution privileges. Impact is local information disclosure (C: Low, I: None, A: None) with a CVSS 3.1 base sc...

CVE-2026-20417

CVE-2026-20417 concerns the PCIe subsystem where a missing bounds check enables an out-of-bounds write, potentially allowing local escalation of privilege if the attacker already has System privileges. Exploitation is described as local with no user interaction required; CVSS v3.1 vector shows lo...

CVE-2026-20445

The CVE-2026-20445 vulnerability affects the MDDP component, where a race condition can cause a system crash leading to local denial of service when the attacker already has System privileges. Exploitation does not require user interaction. The issue is associated with a patch identified as ALPS1...

CVE-2025-11131

The CVE-2025-11131 issue resides in the UNISOC nr modem. The root cause is improper input validation in the modem path, which can cause a system crash and allow remote denial of service without extra privileges. The vulnerability is network-exploitable and does not require user interaction. Publi...

CVE-2025-36920

CVE-2025-36920 describes an out-of-bounds write in the kernel component arch/arm64/kvm/hyp/nvhe/alloc.c’s hyp_alloc function caused by insufficient input validation. The vulnerability enables local escalation of privilege without requiring additional execution privileges, and exploitation reporte...

CVE-2025-48536

CVE-2025-48536 affects Android’s SettingsSliceProvider.java, specifically grantAllowlistedPackagePermissions. A third-party app could abuse a “confused deputy” flaw to modify secure settings, enabling local elevation of privilege with no extra execution privileges and no user interaction required...

CVE-2025-48566

CVE-2025-48566 is reported in multiple sources (Android bulletin and Red Hat) as a local elevation-of-privilege vulnerability in Android Framework related to bypassing user profile boundaries via a forwarded Intent, caused by improper input validation. The issue affects Android Framework componen...

CVE-2025-48594

Technical details for CVE-2025-48594 are not publicly available in the provided documents. No specifics on affected products, versions, root cause, or fixes are disclosed here. Monitor for updates from connected sources.

CVE-2025-61615

CVE-2025-61615 affects NR Modem. The vulnerability is due to improper input validation in NR Modem, which can trigger a system crash and lead to remote denial of service without needing privileges or user interaction. The available sources describe the impact as a denial of service with potential...

CVE-2026-0121

In VPU, a race condition enables a use-after-free read, causing local information disclosure without requiring privileges or user interaction. The issue is documented across multiple sources (NVD/Red Hat/OSV/ENISA/Android Pixel bulletin), with no publicly provided technical details on affected ve...

CVE-2026-0129

The CVE-2026-0129 entry concerns RtcpByePacket::decodeByePacket with a missing bounds check that can lead to remote information disclosure. The available sources (NVD, OSV, PT security, Android Pixel bulletin) indicate this is related to libpixelimsmedia and triggers information disclosure withou...

CVE-2026-0143

The CVE-2026-0143 issue is in LWIS (lwIS) device handling: in lwis_device_external_event_emit of lwis_event.c, a memory corruption via use-after-free is reported, enabling local escalation of privilege with System execution privileges, and no user interaction is required. Public documents from NV...

CVE-2026-20439

Summary (CVE-2026-20439): In imgsys, a use-after-free condition can cause a system crash, enabling local denial of service when an attacker already has System privileges. No user interaction is required. Public technical details are limited in the provided documents; the likely impact is local Do...

CVE-2025-20764

CVE-2025-20764 affects the MediaTek “smi” component, where a missing bounds check allows an out-of-bounds write. This can enable local escalation of privilege for an attacker who already has System privileges, with no user interaction required. The issue is associated with patch ALPS10259774 (Iss...

CVE-2025-20767

CVE-2025-20767 affects MediaTek chipsets. The issue is an out-of-bounds write caused by an integer overflow in display handling, enabling local escalation of privilege if the attacker already has System-level privileges. Exploitation details are not provided in the documents; no user interaction ...

CVE-2025-20777

The CVE-2025-20777 entry describes a local privilege escalation on MediaTek chipsets via an out-of-bounds write caused by a missing bounds check in display handling. This could allow a user with System privileges to elevate to higher privileges without user interaction. Patch ALPS10184870 (MSV-47...

CVE-2025-20807

CVE-2025-20807 affects dpe with an out-of-bounds write caused by an integer overflow. Local privilege escalation is possible if an attacker already has System privileges; no user interaction is required. Patch ALPS10114841 (Issue MSV-4451) is provided as a fix. Connected sources from Red Hat, NVD...

CVE-2025-22420

CVE-2025-22420 is a local elevation-of-privilege vulnerability in the Android Framework that could allow leaking audio files across user profiles due to a confused deputy. Exploitation is described as requiring no user interaction and being locally executable. The Android security bulletin and Re...

CVE-2025-36938

CVE-2025-36938 concerns a fault injection vulnerability in U-Boot function append_uint32_le() caused by a logic error in the code. The issue enables physical elevation of privilege with no additional execution privileges required and no user interaction needed. Multiple sources (NVD/Red Hat/OSVed...

CVE-2025-48525

Summary: CVE-2025-48525 affects the Android Framework (DisassociationProcessor.java). It describes an input validation issue allowing an app to continue reading notifications when not associated to a companion device, enabling local elevation of privilege with no extra privileges and no user inte...

CVE-2025-48590

CVE-2025-48590 affects the Android Framework component AppOpsService (verifyAndGetBypass). The issue describes a resource-exhaustion path that could allow a malicious local app to prevent dialing emergency services, causing local DoS without extra privileges or user interaction. Impact is limited...

CVE-2025-48596

CVE-2025-48596 is an Android/local privilege-escalation flaw caused by an out-of-bounds read in Parcel.cpp:appendFrom due to a missing bounds check. The issue allows local escalation without extra privileges or user interaction. Public references and Red Hat/EUVD/NVD entries describe the same aff...

CVE-2025-48629

CVE-2025-48629 affects the Android framework component in which the insecure default for the default speech recognizer app can be exploited via the VoiceInteractionManagerService.findAvailRecognizer. The root cause is an insecure default value in this method, enabling local privilege escalation w...

CVE-2025-48634

The CVE-2025-48634 entry involves Android’s WindowManagerService relayoutWindow where a missing permission check enables a local elevation-of-privilege (EoP) attack. The vulnerability can be exploited with no user interaction and does not require additional execution privileges. Connected documen...

CVE-2025-48636

The CVE-2025-48636 entry concerns a path traversal vulnerability in openFile of BugreportContentProvider.java that could allow reading and writing unauthorized files, enabling local privilege escalation without extra execution privileges or user interaction. The issue affects the described openFi...

CVE-2025-61613

CVE-2025-61613 involves the nr modem where a flaw in input validation can cause a system crash, leading to remote denial of service with no additional execution privileges required. The affected component is the nr modem (no other product/version details are provided in the documents). The root c...

CVE-2025-71251

CVE-2025-71251 affects the IMS component. The issue is caused by improper input validation, leading to a system crash and remote denial of service without extra privileges or user interaction. CVSS 3.1 metrics: Network attack vector, low attack complexity, no privileges required, no user interact...

CVE-2025-71255

Technical details are not publicly available in the provided documents. Monitor for updates from the vendor and CVE databases to confirm affected products, root cause specifics, and remediation.

CVE-2026-0113

CVE-2026-0113 describes an out-of-bounds write in ns_GetUserData within ns_SmscbUtilities.c that could enable remote escalation of privilege without user interaction. Affected references across multiple feeds corroborate the same flaw and classify it as a high-severity issue with a common-criteri...

CVE-2026-0117

CVE-2026-0117 affects the MFC decoder path in mfc_dec_v4l2.c, where an incorrect bounds check enables an out-of-bounds write. This could lead to local escalation of privileges with no extra execution privileges required and no user interaction needed. The vulnerability is documented across multip...

CVE-2026-0160

The vulnerability CVE-2026-0160 affects the TextRtpPayloadDecoderNode, specifically in DecodeT140 of TextRtpPayloadDecoderNode.cpp. It is caused by a missing bounds check that can result in an out-of-bounds write. The documented impact is remote code execution with no additional privileges requir...

CVE-2026-20424

CVE-2026-20424 affects MediaTek chipsets. It is a missing bounds check in display leading to an out-of-bounds read, potentially exposing local information if an attacker already has System privileges. Exploitation does not require user interaction and is local. Patch: ALPS10320471 (Issue MSV-5540...

CVE-2026-20437

CVE-2026-20437 affects MAE. A use-after-free causes a possible system crash leading to local denial of service when the attacker already has System privileges; no user interaction is required. Patch ALPS10431940 (MSV-5843).