CVE-2026-20440

CVE-2026-20440 concerns MediaTek MAE (MediaTek chipsets). The flaw is an out-of-bounds write caused by a missing bounds check in MAE, enabling local privilege escalation without user interaction once System privileges are held. Affected component/impact: local escalation of privilege with high co...

CVE-2026-28582

CVE-2026-28582 is a missing permission check in the onCreate method of ConfirmDeviceCredentialActivity.java on Android , allowing a local attacker with low privileges (no user interaction required) to read or modify device credentials , resulting in local information disclosure. NVD rates it CVSS...

CVE-2026-28644

CVE-2026-28644 is a permission bypass due to a confused deputy in startNextMatchingActivity of ActivityTaskManagerService.java (Android System). It allows local privilege escalation with no additional execution privileges and no user interaction, rated CVSS 7.8 (High) with full impact to confiden...

CVE-2025-20745

CVE-2025-20745 concerns a memory corruption issue in apusys caused by a use-after-free, enabling local privilege escalation for an attacker with System privileges. The vulnerability does not require user interaction. Affected component: apusys; root cause: use-after-free leading to memory corrupt...

CVE-2025-20800

CVE-2025-20800 affects the MediaTek-related component mminfra. The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege to System level without user interaction. Exploitation details (vectors, exploit code) are not provided in the supplied docum...

CVE-2025-48628

Summary: CVE-2025-48628 affects the Android framework, specifically the PrintManagerService’s validateIconUserBoundary, enabling a cross-user image leak due to a confused deputy and enabling local privilege escalation without extra execution privileges or user interaction. What is affected: Print...

CVE-2025-71256

CVE-2025-71256 affects the nr modem component. The issue is improper input validation that can allow remote denial of service without additional privileges. Attack vector is network with no user interaction; impact is availability degradation (CVE scored with CVSS v3.1 base 7.5, HIGH). Root cause...

CVE-2026-0123

The CVE-2026-0123 entry concerns the EfwApTransport::ProcessRxRing function in efw_ap_transport.cc, where an out-of-bounds write can occur due to a missing bounds check. This vulnerability is described as enabling local elevation of privilege with no additional execution privileges required and n...

CVE-2026-20437

CVE-2026-20437 affects MAE. A use-after-free causes a possible system crash leading to local denial of service when the attacker already has System privileges; no user interaction is required. Patch ALPS10431940 (MSV-5843).

CVE-2026-28596

CVE-2026-28596 is a permanent denial of service vulnerability in the Android Framework component, specifically in the parseInterventionFromXml method of GameManagerService.java. The root cause is resource exhaustion , which can lead to a permanent DoS. Exploitation requires a local attacker with ...

CVE-2026-28599

CVE-2026-28599 is an Intent Redirection Bypass in the addCreatorToken method of ActivityManagerService.java within the Android Framework component, caused by a logic error . It enables local escalation of privilege with no additional execution privileges and no user interaction required, scored C...

CVE-2025-20804

CVE-2025-20804 : The description indicates a memory corruption via a use-after-free in the dpe component, enabling local escalation of privilege to System level with user interaction required for exploitation. The entry notes a Patch ID ALPS10198951 and Issue ID MSV-4503. Public references across...

CVE-2025-61608

CVE-2025-61608 affects Unisoc nr modem. It is caused by improper input validation that can crash the system and enable remote denial of service, with CVSS v3.1 base metrics: AV(Network), AC(Low), PR(None), UI(None), S(Unchanged), C(N/A), I(N/A), A(High) and a base score of 7.5. Public documents d...

CVE-2025-71253

CVE-2025-71253 concerns Modem IMS with an input validation flaw that can allow remote denial of service without extra privileges. The issue is described as improper input validation in Modem IMS, leading to availability impact (high) per CVSS vector: Network access, no user interaction, low attac...

CVE-2026-0115

Technical details for CVE-2026-0115 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-28606

CVE-2026-28606 is a logic error in the handleBondStateChanged method of Android's AdapterService.java , which allows an attacker to skip Bluetooth pairing and achieve remote escalation of privilege without user consent, without additional execution privileges, and without user interaction. The CN...

CVE-2026-28609

CVE-2026-28609 is an out-of-bounds write vulnerability in MatroskaExtractor.cpp , caused by improper casting during a read operation. It can lead to remote code execution with low privileges required and no user interaction needed, rated CVSS 8.8 (HIGH) . The vulnerability is tracked in the Andro...

CVE-2026-28633

CVE-2026-28633 is a persistent denial of service vulnerability in the initForUserNoTracing method of VoiceInteractionManagerService.java , part of the Android Framework. The root cause is resource exhaustion , which can lead to local denial of service requiring only low privileges and no user int...

CVE-2026-28634

This local elevation of privilege vulnerability exists in handleUssdRequest of PhoneInterfaceManager.java in the Android Telephony framework. A logic error allows a malicious app to send a USSD request without the required permission, enabling privilege escalation with only low privileges and no ...

CVE-2025-20744

The CVE-2025-20744 entry concerns the pda component with a use-after-free in privileged context leading to local escalation of privilege. The advisory indicates that a malicious actor who already has System privileges can exploit this without user interaction; no exploit vectors or in-wild detail...

CVE-2025-36936

The CVE-2025-36936 entry concerns Tachyon Server, specifically the GetTachyonCommand function in tachyon_server_common.h. The issue is a potential out-of-bounds write caused by an integer overflow, enabling local elevation of privilege with no additional execution privileges required and no user ...

CVE-2025-20723

The CVE-2025-20723 entry concerns the gnss driver. It describes an out-of-bounds write caused by an incorrect bounds check, potentially enabling local privilege escalation to System level without user interaction. A patch is identified (ALPS09920033) and the associated issue MSV-3797. Connected s...

CVE-2025-20769

CVE-2025-20769 is described across multiple sources as a local-out-of-bounds write in display logic due to a missing bounds check, potentially enabling local escalation of privilege to System level without user interaction on MediaTek chipsets. Patch: ALPS10196993 (MSV-4804). Affected components ...

CVE-2025-20770

CVE-2025-20770 involves a memory corruption via use-after-free in display handling on MediaTek chipsets, resulting in local privilege escalation if an attacker already has System privileges. No user interaction is required. The vulnerability affects the component responsible for display/memory ha...

CVE-2025-20775

CVE-2025-20775 affects MediaTek chipsets’ display component. The issue is a memory corruption due to a use-after-free in display, allowing local escalation of privilege to System level without user interaction. Affected versions are prior to Patch ID ALPS10182914; the patch/mitigation is ALPS1018...

CVE-2025-20788

CVE-2025-20788 affects the GPU PDMA path in MediaTek chipsets. The issue is a memory corruption caused by a missing permission check, which can enable local denial of service with no additional execution privileges required. Exploitation requires user interaction. A patch is available: ALPS101177...

CVE-2025-20806

Impactful but constrained: CVE-2025-20806 is a memory corruption via use-after-free in dpe that could enable local escalation of privilege to System level. Exploitation requires local access; no user interaction is needed. Root cause is use-after-free vulnerability in dpe; no explicit affected pr...

CVE-2025-61617

CVE-2025-61617 affects Unisoc’s NR modem, with a potential remote denial-of-service caused by improper input validation. The description and Red Hat/NVD entries confirm a system crash possibility without requiring privileges. Connected sources reference an Android/Samsung patching context for rel...

CVE-2025-20776

CVE-2025-20776 affects MediaTek chipsets with an out-of-bounds read caused by a missing bounds check. This can enable local privilege escalation to System level without user interaction. Exploitation status is not detailed in the provided documents. Patch: ALPS10184297 (MSV-4759) is referenced. N...

CVE-2025-20789

In GPU pdma on affected MediaTek platforms, a missing bounds check can lead to local information disclosure. The vulnerability allows leakage of information without extra privileges, with exploitation requiring user interaction. A patch is referenced (ALPS10117741; MSV-4538). Affected component i...

CVE-2025-20798

MediaTek chipsets/Battery component contains an out-of-bounds write due to a missing bounds check, enabling local privilege escalation if an attacker already has System privileges. User interaction is not required. Patch ALPS10315812 and Issue MSV-5533 address this. Exploitation details are not p...

CVE-2026-28617

CVE-2026-28617 affects the WiFi subcomponent of Android's Project Mainline, specifically in WifiNetworkSuggestionsManager.java . The root cause is a persistent denial-of-service due to resource exhaustion , enabling a local attacker to degrade device availability without requiring additional priv...

CVE-2025-48608

CVE-2025-48608 affects the Android SettingsProvider.java isValidMediaUri path, enabling cross-user media read due to a missing permission check. The issue permits local information disclosure without user interaction (ATT&CK: T1552-like, per the description), with CVSS 3.1 base score 5.5 (AV:L/AC...

CVE-2026-0110

CVE-2026-0110 describes a memory corruption issue in MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp that can lead to a remote elevation of privilege with no additional execution privileges or user interaction required. The vulnerability is referenced across multiple sources (NVD, Red Hat, EUVD, CVE reco...

CVE-2026-0112

CVE-2026-0112 describes a use-after-free in vpu_open_inst of vpu_ioctl.c caused by a race condition, enabling local privilege escalation with no extra execution privileges or user interaction required. Multiple feeds (NVD/Red Hat/EUVD/PT Security/OSV) report the same description. The connected so...

CVE-2026-28572

CVE-2026-28572 is an elevation of privilege vulnerability in the Android Framework component, specifically in the onCreate method of InstallLaunch.kt. A tapjacking/overlay attack can produce a misleading UI, enabling a local attacker to escalate privileges with no additional execution privileges ...

CVE-2026-28607

CVE-2026-28607 is a local elevation of privilege vulnerability in the Android Framework component, caused by a background activity launch bypass due to a confused deputy in multiple functions across multiple locations. No additional execution privileges or user interaction are required for exploi...

CVE-2026-28613

CVE-2026-28613 affects Android (per the Android Security Bulletin 2026-09-01 ). The vulnerability resides in the initAppLinkTypeAndIntent function of ChannelImpl.java , where improper input validation allows an arbitrary intent to be launched , leading to local privilege escalation with no additi...

CVE-2026-28653

CVE-2026-28653 is an integer overflow vulnerability in multiple functions of rw_t3t.cc , an Android media framework component responsible for T3T codec handling. The overflow leads to an out-of-bounds write , enabling local privilege escalation with no additional execution privileges or user inte...

CVE-2026-28616

CVE-2026-28616 is a vulnerability in the Android Setup Wizard component. Due to a confused deputy flaw, a local attacker can force the device to connect to a malicious network, enabling local escalation of privilege without requiring additional execution privileges or user interaction. The CVSS 3...

CVE-2026-28622

CVE-2026-28622 affects the Media Provider component in Android's Project Mainline, specifically in getQueryBuilderInternal of MediaProvider.java. A permissions bypass allows retrieval of location metadata , resulting in local information disclosure with no additional execution privileges or user ...

CVE-2026-28655

CVE-2026-28655 is a logic error in multiple functions of RemoteViews.java within the Android framework that permits a background activity launch bypass , enabling local privilege escalation. Exploitation requires low privileges , no user interaction, and no additional execution rights, yet can re...

CVE-2026-49883

CVE-2026-49883 affects Android Wear (per the 2026-09-01 security bulletin) and involves a missing permission check in the checkReadPermission method of PermissionsManager.java. This allows an attacker to monitor sensitive device state data without requiring additional execution privileges or user...

CVE-2026-28658

CVE-2026-28658 is a local privilege escalation vulnerability in the findMetaAuthUid function of AccountsDb.java within the Android platform, caused by a logic error that allows a file resource protection (FRP) bypass . An attacker with low local privileges can exploit it without user interaction,...

CVE-2026-28662

CVE-2026-28662 is a heap buffer overflow in the p2p_process_prov_disc_bootstrap_req function of p2p_pd.c within the Android P2P (Wi-Fi Direct) stack . The out-of-bounds write can lead to remote code execution from an adjacent network with low privileges and no user interaction required. The vulne...

CVE-2026-28656

This vulnerability affects DeviceAdminAdd.java in Android Wear (disclosed in the 2026-09-01 security bulletin). Multiple functions are susceptible to a tapjacking/overlay attack , allowing a local escalation of privilege with only low privileges and user interaction required. The CVSS 3.1 score i...

CVE-2026-28660

CVE-2026-28660 is a local information disclosure vulnerability in the Android Framework component, caused by a confused deputy due to a logic error in the getAllSessions function across multiple files (AOSP bug A-498588487 ). A local attacker with low privileges can exploit it without user intera...

CVE-2026-28611

CVE-2026-28611 is a vulnerability in Android's NfcService.java where a missing permission check in multiple functions enables a silent NFC payment session hijacking , leading to local privilege escalation with no additional execution privileges or user interaction required. The CVSS 3.1 score is ...

CVE-2026-28657

CVE-2026-28657 is a local escalation of privilege vulnerability in Android , specifically in the onActivityResult method of AppWidgetConfigActivityProxy.java. The root cause is a confused deputy flaw that allows an unauthorized URI permission grant . Exploitation requires only low privileges, no ...

CVE-2026-28626

CVE-2026-28626 is an Intent redirection vulnerability in the onCreate method of SetupPassthroughActivity.java within the Android platform. An attacker with local access can launch an arbitrary activity, potentially enabling local privilege escalation without additional execution privileges, thoug...