CVE-2025-20807

CVE-2025-20807 affects dpe with an out-of-bounds write caused by an integer overflow. Local privilege escalation is possible if an attacker already has System privileges; no user interaction is required. Patch ALPS10114841 (Issue MSV-4451) is provided as a fix. Connected sources from Red Hat, NVD...

CVE-2025-32316

CVE-2025-32316 affects the Android graphics allocator: in gralloc4, a missing bounds check allows an out-of-bounds write, leading to local information disclosure without requiring user interaction or extra privileges. The NVD/Red Hat CNVD entries confirm the same issue; the Android 16 bulletin in...

CVE-2025-32329

CVE-2025-32329 affects Android Framework (Session.java). The described issue is a logic error in multiple Session.java functions that can permit viewing images belonging to another user on the device. This leads to local escalation of privilege with no additional execution privileges required and...

CVE-2025-48586

Summary: CVE-2025-48586 relates to Android's EditFdnContactScreen.java: In onActivityResult, a confused-deputy flaw could leak contacts from the work profile, enabling local elevation of privilege with no extra privileges and no user interaction. Affected component: Android app code path in EditF...

CVE-2026-0155

CVE-2026-0155 describes an OOB read in ImsMediaBitReader::ReadByteBuffer caused by a missing bounds check. This leads to remote information disclosure without additional execution privileges and requires no user interaction. The CVSS 3.1 vector indicates Network access with low attack complexity ...

CVE-2026-20439

Summary (CVE-2026-20439): In imgsys, a use-after-free condition can cause a system crash, enabling local denial of service when an attacker already has System privileges. No user interaction is required. Public technical details are limited in the provided documents; the likely impact is local Do...

CVE-2026-28587

CVE-2026-28587 affects the MmsSmsProvider component (MmsSmsProvider.java), enabling local information disclosure via a missing permission check. Exploitation requires no user interaction and does not require additional privileges; impact is confined to information disclosure. The vulnerability is...

CVE-2026-28638

CVE-2026-28638 is an information disclosure flaw in XmpDataParser.java within Android's Media Provider component, caused by improper data sanitization due to a logic error. It allows local disclosure of information without additional privileges or user interaction. The vulnerability affects Andro...

CVE-2025-20784

CVE-2025-20784 affects MediaTek chipsets in the display component, where a memory corruption due to uninitialized data could allow local escalation to System privileges. Exploitation does not require user interaction. The issue is mitigated by patch ALPS10182882 (MSV-4683). The available connecte...

CVE-2025-36891

CVE-2025-36891 is an Elevation of Privilege affecting the Pixel WLAN subsystem (Android). The Pixel Update Bulletin classifies it as WLAN-related EoP with High severity and CVSSv3.1: 8.8 (Network attack vector, low attack complexity, low privileges required, no user interaction, scopes unchanged;...

CVE-2025-36904

CVE-2025-36904 maps to a WLAN elevation-of-privilege issue on Google Pixel devices. Connected OSV data describes a Broadcom Wi‑Fi driver vulnerability in wl_android_get_best_channels, an out-of-bounds write caused by unvalidated list->count. The Pixel bulletin indicates updating to 2025-09-05 ...

CVE-2025-36918

CVE-2025-36918 describes an out-of-bounds read in the function aoc_service_read_message within aoc_ipc_core.c , leading to a possible local escalation of privilege with System privileges required. The prerequisite is local access; no user interaction is needed. Connected sources consistently refe...

CVE-2025-48566

CVE-2025-48566 is reported in multiple sources (Android bulletin and Red Hat) as a local elevation-of-privilege vulnerability in Android Framework related to bypassing user profile boundaries via a forwarded Intent, caused by improper input validation. The issue affects Android Framework componen...

CVE-2025-48603

Technical details are not publicly available in the provided documents for CVE-2025-48603; monitor for updates as more data may be published by vendors and trackers.

CVE-2025-48629

CVE-2025-48629 affects the Android framework component in which the insecure default for the default speech recognizer app can be exploited via the VoiceInteractionManagerService.findAvailRecognizer. The root cause is an insecure default value in this method, enabling local privilege escalation w...

CVE-2025-69279

CVE-2025-69279 concerns a vulnerability in the nr modem where improper input validation can cause a system crash, enabling remote denial of service without requiring privileges. Multiple sources (NVD, Red Hat, EUVD, CVE list, etc.) describe the issue consistently, identifying the affected compone...

CVE-2026-0057

CVE-2026-0057 affects the Android Contacts Provider. A missing permission check can allow an attacker to read an incoming call’s phone number and related metadata, enabling local information disclosure without extra execution privileges, and exploitation does not require user interaction. The iss...

CVE-2026-0121

In VPU, a race condition enables a use-after-free read, causing local information disclosure without requiring privileges or user interaction. The issue is documented across multiple sources (NVD/Red Hat/OSV/ENISA/Android Pixel bulletin), with no publicly provided technical details on affected ve...

CVE-2026-0132

CVE-2026-0132 concerns the Modem component. The connected documents describe a vulnerability where an out-of-bounds write occurs due to a heap buffer overflow, enabling remote code execution with no additional privileges and no user interaction required. The CVSS metrics indicate network attack v...

CVE-2026-20412

The CVE-2026-20412 issue affects the cameraisp component and involves an out-of-bounds write caused by a missing bounds check. This could enable local privilege escalation if an attacker already has System privileges, with no user interaction required. A patch is identified as ALPS10351676 (Issue...

CVE-2026-20424

CVE-2026-20424 affects MediaTek chipsets. It is a missing bounds check in display leading to an out-of-bounds read, potentially exposing local information if an attacker already has System privileges. Exploitation does not require user interaction and is local. Patch: ALPS10320471 (Issue MSV-5540...

CVE-2026-20442

CVE-2026-20442 affects MediaTek chipsets and is caused by a use-after-free in the display path, leading to a possible local crash and denial of service when the attacker already has System privileges. Exploitation does not require user interaction and is local (attack vector: local). The conditio...

CVE-2025-20705

CVE-2025-20705 concerns a memory corruption issue (use-after-free) in the MediaTek Modem’s monitor_hang path that could enable local privilege escalation if an attacker already has System privileges. Exploitation is described as not requiring user interaction. The vulnerability is tied to a patch...

CVE-2025-20780

CVE-2025-20780 describes a memory corruption use-after-free in display code that can enable local privilege escalation for an attacker already with System privileges; exploitation does not require user interaction. Affected entity is MediaTek chipsets’ display subsystem (root cause: use-after-fre...

CVE-2025-26431

CVE-2025-26431 affects Android Wear OS (and related Android framework components) through a logic error in setupAccessibilityServices inside AccessibilityFragment.java that can cause an enabled accessibility service to be hidden. This enables local privilege escalation with no extra privileges an...

CVE-2025-36916

CVE-2025-36916 affects code path in PrepareWorkloadBuffers of gxp_main_actor.cc, where a race condition can cause a double fetch. This permits local escalation of privilege with no extra execution privileges and no user interaction needed; exploitation is local. Connected documents corroborate th...

CVE-2025-48590

CVE-2025-48590 affects the Android Framework component AppOpsService (verifyAndGetBypass). The issue describes a resource-exhaustion path that could allow a malicious local app to prevent dialing emergency services, causing local DoS without extra privileges or user interaction. Impact is limited...

CVE-2025-48606

CVE-2025-48606 is a logic-error-based vulnerability in Android’s InstallPackageHelper.java (preparePackage) that can cause an app to appear hidden at install, without an uninstall mechanism, enabling local privilege escalation with no extra execution privileges and no user interaction. It is docu...

CVE-2025-48612

CVE-2025-48612 affects Android work-profile contexts where an app can alter the main user's NFC payment default due to improper input validation at multiple locations. The root cause is input validation issues that enable a local escalation of privilege without additional execution privileges or ...

CVE-2025-48613

The CVE-2025-48613 entry describes a vulnerability in VBMeta where an attacker can modify and resign VBMeta using a test key, assuming the original image was signed with the same key. This could enable local privilege escalation with no additional privileges or user interaction. Connected sources...

CVE-2025-61613

CVE-2025-61613 involves the nr modem where a flaw in input validation can cause a system crash, leading to remote denial of service with no additional execution privileges required. The affected component is the nr modem (no other product/version details are provided in the documents). The root c...

CVE-2026-0084

CVE-2026-0084 is a local privilege escalation vulnerability in the Android framework , specifically in multiple functions of HostEmulationManager.java. A logic error permits an unintended background activity launch, allowing a local attacker to escalate privileges with no additional execution pri...

CVE-2026-0128

CVE-2026-0128 affects code in RtcpFbPacket::decodeRtcpFbPacket, where an integer overflow can trigger an out-of-bounds read. This could lead to remote information disclosure without extra privileges. Exploitation requires user interaction. The connected documents consistently describe the same is...

CVE-2026-0133

Affected component: arm-smmu-v3.c (smmu_attach_dev). The issue is a missing permission check that can allow signing malicious Android Runtime bootclass artifacts, enabling local escalation of privilege without extra execution privileges. Exploitation requires local access; user interaction is not...

CVE-2026-20416

The CVE-2026-20416 entry concerns an out-of-bounds write in pcie caused by a missing bounds check, enabling local privilege escalation to System level without user interaction. Affected scope includes MediaTek-based PCIe components (as reflected across NVD/Red Hat OSV, CVE lists, and PT-security ...

CVE-2025-20768

CVE-2025-20768: A memory bounds-checking fault causes an out-of-bounds read, enabling local privilege escalation if an attacker already has SYSTEM privileges. No user interaction required. Patch ALPS10196993 (MSV-4805) is available; impact is described with HIGH confidentiality/integrity/availabi...

CVE-2025-20773

The CVE-2025-20773 entry describes a memory corruption via use-after-free in the MediaTek chipsets display path, enabling local escalation of privilege for an attacker already with System privileges. No user interaction is required. The vulnerability impact is described as high for confidentialit...

CVE-2025-32319

CVE-2025-32319 affects the Android Framework, specifically the ensureBound path in RemotePrintService.java. The issue permits a background app to bypass foreground permissions, enabling local elevation of privilege with user-execution privileges required yet no user interaction needed for exploit...

CVE-2025-36919

CVE-2025-36919: A double-free condition in aocc_read within aoc_channel_dev.c due to improper locking enables local elevation of privilege. Exploitation requires local access (no user interaction). Multiple feeds (NVD/Red Hat/CNVD/CVELIST) reference the same issue with AoC component; Pixel Androi...

CVE-2025-36924

CVE-2025-36924 describes an out-of-bounds write in ss_DecodeLcsAssistDataReqMsg() within ss_LcsManagement.c due to an incorrect bounds check. The impact is remote escalation of privilege with no additional execution privileges needed and no user interaction required. Connected sources include And...

CVE-2025-36931

CVE-2025-36931: Out-of-bounds write in GetHostAddress of gxp_buffer.h allows local privilege escalation without user interaction. Documented in multiple sources (e.g., Android Pixel bulletin) as a local issue related to Pixel devices; patch guidance indicates updating to the December 2025 patch l...

CVE-2025-48536

CVE-2025-48536 affects Android’s SettingsSliceProvider.java, specifically grantAllowlistedPackagePermissions. A third-party app could abuse a “confused deputy” flaw to modify secure settings, enabling local elevation of privilege with no extra execution privileges and no user interaction required...

CVE-2025-48594

Technical details for CVE-2025-48594 are not publicly available in the provided documents. No specifics on affected products, versions, root cause, or fixes are disclosed here. Monitor for updates from connected sources.

CVE-2025-48604

Technical details for CVE-2025-48604 are not publicly provided in the connected documents. Monitoring for updates is advised as more specifics (affected products, versions, and fixes) may be released.

CVE-2025-48636

The CVE-2025-48636 entry concerns a path traversal vulnerability in openFile of BugreportContentProvider.java that could allow reading and writing unauthorized files, enabling local privilege escalation without extra execution privileges or user interaction. The issue affects the described openFi...

CVE-2025-61615

CVE-2025-61615 affects NR Modem. The vulnerability is due to improper input validation in NR Modem, which can trigger a system crash and lead to remote denial of service without needing privileges or user interaction. The available sources describe the impact as a denial of service with potential...

CVE-2026-0118

Technical details about CVE-2026-0118 are not publicly provided in the supplied documents. Monitor for updates from the sources listed; the available descriptions indicate a local privilege escalation via oobconfig bypass but lack specifics.

CVE-2026-0129

CVE-2026-0129 is a remote information disclosure vulnerability in the libpixelimsmedia component of Google Pixel devices, specifically in the RtcpByePacket::decodeByePacket function. The root cause is a missing bounds check that allows an out-of-bounds read. Exploitation requires user interaction...

CVE-2026-0131

The CVE-2026-0131 entry affects the code path In RtpPacket::decodePacket, where an integer overflow can cause an out-of-bounds access. This vulnerability could enable local escalation of privilege with no additional execution privileges required, and exploitation requires user interaction. Connec...

CVE-2026-0158

CVE-2026-0158 is an information disclosure vulnerability in the Camera component of Google Pixel devices, caused by a missing permission check that allows unauthorized local access to photos without requiring additional execution privileges or user interaction. The Pixel Update Bulletin for June ...