CVE-2019-2094

CVE-2019-2094 affects Android media framework (NuPlayerCCDecoder.cpp). The issue is a possible out-of-bounds write in parseMPEGCCData due to missing bounds checks, enabling remote code execution with no extra privileges and requiring user interaction to exploit. Impact is high (RCE, high confiden...

CVE-2019-9254

CVE-2019-9254 affects Android 10 in zygote.java (readArgumentList). Describes a command injection due to improper input validation that could enable local privilege escalation without user interaction. Impact is defined as local EoP with high severity (C/C/I/A). Mitigation: patch levels 2019-09-0...

CVE-2020-0259

CVE-2020-0259 affects the Android kernel AMLogic dm-verity component (dm-android-verity.c). The vulnerability arises from improper crypto usage in android_verity_ctr, allowing a local attacker to modify a dm-verity protected filesystem and gain elevation of privilege with no additional execution ...

CVE-2021-0303

The CVE-2021-0303 issue is a use-after-free race in dispatchGraphTerminationMessage() within StreamSetObserver.cpp used by Android 11. It enables local privilege escalation with user privileges and does not require user interaction. Red Hat and OSV entries corroborate the same file path and impac...

CVE-2021-0507

CVE-2021-0507 corresponds to an Android Bluetooth flaw in btif_rc.cc (handle_rc_metamsg_cmd) where a missing bounds check can cause an out-of-bounds write. This flaw could enable remote code execution over Bluetooth with no extra privileges and without user interaction. Affected Android versions ...

CVE-2021-0589

CVE-2021-0589 is an Android local privilege escalation vulnerability: an out-of-bounds write in BTM_TryAllocateSCN (btm_scn.cc) caused by an incorrect bounds check, enabling local execution as a privileged context without user interaction. Affected Android versions include 8.1, 9, 10, and 11 (per...

CVE-2021-0641

CVE-2021-0641: A missing permission check in getAvailableSubscriptionInfoList() of SubscriptionController.java allows disclosure of unique identifiers and local information disclosure without extra execution privileges on Android 8.1–11. The NVD entry rates the base CVSSv3 as 5.5 (LOCAL, LOW comp...

CVE-2022-20338

Summary: CVE-2022-20338 affects Android (Android-11, Android-12, Android-12L, Android-13) due to a vulnerability in HierarchicalUri.readFrom in Uri.java that allows crafting a malformed URI because of improper input validation, enabling local escalation of privilege without extra execution privil...

CVE-2022-20467

The CVE-2022-20467 issue affects Android 11–13 where the function isBluetoothShareUri in BluetoothOppUtility.java can read files incorrectly due to a confused deputy, causing local information disclosure with no extra execution privileges. Exploitation requires user interaction, with local attack...

CVE-2022-20484

CVE-2022-20484 affects Android 10–13 where NotificationChannel.java’s permission persistence can fail due to resource exhaustion, enabling local elevation of privilege with no user interaction needed. CVSSv3.1 metrics indicate LOCAL access, LOW privileges, UI None, and HIGH impact on confidential...

CVE-2023-20913

CVE-2023-20913 affects Android 10–13; a tapjacking/overlay issue in PhoneAccountSettingsActivity could enable local elevation of privilege by tricking the user into enabling a malicious phone account. The Android Security Bulletin lists this issue under the 2023-01-01 and 2023-01-05 patch levels;...

CVE-2023-20945

CVE-2023-20945 affects Android 10 and is due to an out-of-bounds write in phNciNfc_MfCreateXchgDataHdr within phNxpExtns_MifareStd.cpp, caused by a missing bounds check. This leads to local elevation of privilege with no extra execution privileges required and no user interaction. Remediation is ...

CVE-2023-21143

CVE-2023-21143 is a local DoS in Android 11–13 due to improper input validation across multiple functions/files. The issue can render a device unusable without extra privileges or user interaction. The Android Security Bulletin lists this CVE under the System/DoS category for Android 11–13 and no...

CVE-2023-21278

CVE-2023-21278 affects Google Android, appearing in the Android 2023-08-01/08-01 bulletin under the Framework/EoP category. The issue is a logic error in multiple locations that can obscure the microphone privacy indicator, enabling local elevation of privilege without additional execution privil...

CVE-2023-21288

The CVE-2023-21288 entry affects Android via the Notification.java component, where in the visitUris method a missing permission check could allow information disclosure across users. Impact: local information disclosure with User privileges required; exploitation does not require user interactio...

CVE-2023-35658

CVE-2023-35658 affects the Android Bluetooth stack (gatt_process_prep_write_rsp in gatt_cl.cc), where a use-after-free can cause privilege escalation and remote code execution without extra privileges or user interaction. The issue is described across multiple sources as a proximal code execution...

CVE-2023-35670

Android CVE-2023-35670 arises from a path traversal flaw in FileUtils.java (computeValuesFromData) that can allow inserting files into other apps’ external private directories. This enables local elevation of privilege without additional execution privileges or user interaction, as described in t...

CVE-2024-0047

CVE-2024-0047 corresponds to a DoS in Android (Android Open Source Project) caused by a logic error in UserManagerService.java: writeUserLP serializes a device policy with an incorrect tag, enabling local denial of service when policies are deserialized on reboot. Exploitation requires local acce...

CVE-2024-43095

CVE-2024-43095 is an elevation-of-privilege vulnerability in Google Android System (Permission Controller) caused by a logic error. It enables local privilege escalation and is listed as a High-severity EoP issue affecting Android 12–15. The Android security bulletin (January 2025) notes updated ...

CVE-2019-2175

CVE-2019-2175 affects Android 9; in SliceManagerService.java, checkAccess has an incorrect argument order that can bypass permissions and enable local privilege escalation with user interaction required. Affected component is the Android Framework (SliceManagerService) on Android 9. The issue is ...

CVE-2020-0077

CVE-2020-0077 affects the FPC Iris TZ App (TrustZone) on Android. Description: an out-of-bounds read in authorize_enroll due to a missing bounds check, enabling local information disclosure with System privileges needed; exploitation does not require user interaction. Connected sources corroborat...

CVE-2020-0379

CVE-2020-0379 affects the Bluetooth service in Android 8.0–11, where a logic error enables spoofing and potential remote information disclosure without extra execution privileges. Exploitation requires user interaction. The issue is categorized as an Information Disclosure/ID within multiple Andr...

CVE-2021-0319

CVE-2021-0319 affects Android versions 8.0 through 11. It concerns CompanionDeviceManagerService.checkCallerIsSystemOr, where a permissions bypass may allow a local attacker to obtain a nearby Bluetooth device’s MAC address without proper permissions, enabling local privilege escalation to access...

CVE-2021-0337

CVE-2021-0337 affects Android (8.1–11) via moveInMediaStore in FileSystemProvider.java. A stale-metadata file exposure could enable local escalation of privilege with User execution privileges; exploitation does not require user interaction. Public technical details are limited in the provided do...

CVE-2021-0473

CVE-2021-0473 affects Android via a double-free in rw_t3t_process_error in rw_t3t.cc, caused by uninitialized data, enabling remote code execution over NFC with no privileges and no user interaction required. Affected versions include Android-8.1, 9, 10, 11 per the description. The initial docume...

CVE-2021-0478

Technical details beyond the initial description are not provided in the connected documents. Monitor for updates from Android/vendor advisories to confirm affected components, root cause, and fixes.

CVE-2021-0652

Technical details for CVE-2021-0652 are not available in the provided connected documents. The Initial document notes a memory corruption in VectorDrawable and local privilege escalation on Android, but there are no specific product/version, exploit, impact, or remediation details in the supplied...

CVE-2022-20412

CVE-2022-20412 affects Android 10–13. It is caused by an out-of-bounds read in fdt_next_tag (fdt.c) due to an incorrect bounds check, enabling local escalation of privilege to System privileges without user interaction. Impacted components: system/kernel path in Android’s fdt handling. The NVD en...

CVE-2023-20930

CVE-2023-20930 affects Android 11–13 where the pushDynamicShortcut function in ShortcutPackage.java can exhaust resources and cause the device to boot loop, yielding local DoS without extra privileges or user interaction. The issue is documented in the Android May 2023 security bulletin with patc...

CVE-2023-20931

In CVE-2023-20931, the issue is an out-of-bounds write caused by a heap buffer overflow in avdt_scb_hdl_write_req (avdt_scb_act.cc) that could enable local privilege escalation on Android 11–13. The description confirms the vulnerability requires no user interaction and can be exploited locally w...

CVE-2023-21104

CVE-2023-21104 affects Android (Android-12L/Android-13) via a missing permission check in WindowOrganizer.java (applySyncTransaction), enabling local information disclosure without extra execution privileges. Impact is information leakage; exploitation requires no user interaction and is locally ...

CVE-2023-21118

The CVE-2023-21118 entry concerns a vulnerability in Android where the unflattenString8 function in Sensor.cpp can read beyond a heap buffer due to a missing bounds check, causing local information disclosure without extra privileges. Affected products/versions include Android 11, 12, 12L, and 13...

CVE-2023-21137

CVE-2023-21137 affects Android platforms (Android 11, 12, 12L, 13). Root cause: uncaught exceptions in JobStore.java during job map parsing, leading to a local persistent denial of service. Impact is DoS without requiring user interaction or elevated privileges; exploitation is local. Public refe...

CVE-2024-20104

CVE-2024-20104 affects MediaTek DA (the DA component in MediaTek chipsets). It describes an out-of-bounds write due to a missing bounds check, potentially enabling local privilege escalation without additional execution privileges; user interaction is required to exploit. The entry cites patch AL...

CVE-2024-32929

CVE-2024-32929 affects the Pixel GPU driver path gpu_slc_get_region in pixel_gpu_slc.c. A use-after-free in that function can cause a local elevation of privilege, with no additional execution privileges needed and no user interaction required. Public details across connected records confirm the ...

CVE-2024-39431

The CVE-2024-39431 issue affects Unisoc chipsets’ UMTS RLC driver, where a missing bounds check can cause an out-of-bounds write. This can lead to remote denial of service with system privileges. Public references confirm the vulnerable component as the UMTS RLC driver and describe the exploit su...

CVE-2016-6754

CVE-2016-6754: A remote code execution vulnerability in Android WebView affects WebView on Android 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-11-05). Exploitation could occur while a user navigates to a website, with the issue exploitable in an unprivileged process. Remediat...

CVE-2019-2098

CVE-2019-2098 affects Android 7.0–9 and is tied to a missing permissions check in NotificationManagerService.java areNotificationsEnabledForPackage, enabling local elevation of privilege with no additional privileges and no user interaction required. The issue impacts Android’s System/notificatio...

CVE-2019-2108

CVE-2019-2108 affects Android 10 in the Media framework component. The issue is an out-of-bounds write in ihevcd_ref_list.c caused by a missing bounds check, enabling remote code execution with the attacker needing user interaction. The Android 2019-09-05 patch level (and later) addressing this i...

CVE-2019-2173

CVE-2019-2173 involves the Android Framework component where in startActivityMayWait of ActivityStarter.java an incorrect permission check can launch an Activity improperly. This creates a local elevation of privilege risk on affected Android versions: 7.1.1, 7.1.2, 8.0, 8.1, and 9. The issue doe...

CVE-2021-0320

CVE-2021-0320 affects Android 10/11, describing a race condition in keystore_keymaster_enforcement.h (is_device_locked and set_device_locked) that could bypass lockscreen requirements for keyguard-bound keys. This may lead to local information disclosure without additional privileges, and exploit...

CVE-2021-0968

CVE-2021-0968 affects Android 9–12. The issue is an out-of-bounds write caused by an integer overflow in allocator.cc (osi_malloc/osi_calloc), potentially enabling remote code execution with no user interaction. Public details indicate patch levels for 2021-12-01/2021-12-05 Android Bulletins addr...

CVE-2023-20946

CVE-2023-20946 affects Android 11–13 (Android 11, 12, 12L, 13). Root cause is a permission bypass in onStart of BluetoothSwitchPreferenceController.java (confused deputy), enabling remote elevation of privilege in Bluetooth settings with no user interaction. The NVD metrics show a critical CVSS v...

CVE-2023-20964

The CVE-2023-20964 entry affects Android (Android-12/12L/13) via MediaSessionRecord.java, where an Intent rebroadcast in multiple functions can cause local denial of service or privilege escalation without extra execution privileges and with no user interaction required. The vulnerability is clas...

CVE-2023-20967

CVE-2023-20967 is an Android elevation-of-privilege vulnerability in the function avdt_scb_hdl_pkt_no_frag within avdt_scb_act.cc. A faulty bounds check allows an out-of-bounds write, enabling local privilege escalation with no additional execution privileges required and no user interaction. Aff...

CVE-2023-35676

CVE-2023-35676 describes an elevation-of-privilege issue in Android related to an unsafe PendingIntent in the CreateQuickShareAction flow inside SaveImageInBackgroundTask.java. The vulnerability can trigger a background activity launch, enabling local privilege elevation with no additional execut...

CVE-2024-20148

CVE-2024-20148 concerns MediaTek wlan STA FW where an improper input validation leads to an out-of-bounds write. The vulnerability could enable remote code execution on proximal devices with no privileges and no user interaction required. Patch IDs associated are WCNCR00389045 and ALPS09136494 (M...

CVE-2015-6644

CVE-2015-6644 : The vulnerability concerns Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01. A crafted application can cause the library to leak sensitive information, enabling an attacker who can force a user to run a malicious app to obtain private data. The connected docu...

CVE-2021-0683

CVE-2021-0683 (Android) : In runTraceIpcStop of ActivityManagerShellCommand.java, a confused deputy can trigger deletion of system files, causing local escalation of privilege without additional execution privileges. Affected: Android 8.1, 9, 10, 11. CVSSv3.1 base score 7.8 (HIGH). Exploitation r...

CVE-2021-39631

CVE-2021-39631 affects Android (Android-10 to Android-12). The issue lies in clear_data_dlg_text in strings.xml, where the messaging around the lear storageunctionality can mislead about security/privacy, enabling local information disclosure. Exploitation is local, requires no user interaction...