CVE-2023-40095

CVE-2023-40095 describes a likely local elevation of privilege in Android Framework due to a missing check in PendingIntentUtils.createDontSendToRestrictedAppsBundle. Exploitation does not require user interaction and could enable background activity launches on affected devices. Connected source...

CVE-2024-20144

CVE-2024-20144 affects V6 DA, with an out-of-bounds write caused by a missing bounds check. This can enable local escalation of privilege when an attacker has physical access, requiring user interaction for exploitation. Patch ALPS09167056 fixes MSV-2041 for affected devices. No explicit exploita...

CVE-2024-25991

CVE-2024-25991 affects Google/Pixel devices and relates to the ACPM/TMU component. The root cause is a missing bounds check in the function acpm_tmu_ipc_handler within tmu_plugin.c, leading to a possible out-of-bounds read. Impact is information disclosure localized to the attacker’s host with no...

CVE-2025-20636

CVE-2025-20636 involves MediaTek MT8798 secmem module where a missing bounds check can cause an out-of-bounds write. This could enable local privilege escalation if an attacker already has System privileges, with no user interaction required. The available references list a patch: ALPS09403554 (M...

CVE-2016-2434

CVE-2016-2434 affects NVIDIA Tegra kernel driver (NVHOST) on Android/Nexus 9. An attacker can write an arbitrary value to an arbitrary location, leading to privilege escalation in the kernel. The issue is tied to the NVIDIA video driver in Android before 2016-05-01. Impact is described as local p...

CVE-2020-0241

CVE-2020-0241 is a Media Framework issue in Android (NuPlayerStreamListener.cpp) where a double free leads to memory corruption, enabling local privilege escalation with no user interaction. Affected: Android 8.0–10. Root cause: memory-management error in NuPlayerStreamListener. Impact: local ele...

CVE-2020-0409

CVE-2020-0409 affects Android (Android-8.0/8.1/9/10). The issue is an out-of-bounds write in FileMap.cpp caused by an integer overflow in create(), enabling local elevation of privilege with no user interaction. In the public docs, severity is high for local access with partial confidentiality/ i...

CVE-2022-22266

Technical details about CVE-2022-22266 are not publicly available in the connected documents; the description provided is the extent of information here. Monitor for updates.

CVE-2022-47460

CVE-2022-47460 describes a memory corruption via a use-after-free in the GPU device that can lead to local denial of service in the kernel. The connected records corroborate a kernel-level use-after-free affecting GPU-related paths and kernel space, with the impact explicitly stated as local DoS....

CVE-2023-21101

CVE-2023-21101 concerns a race condition in WVDrmPlugin.cpp that leads to a use-after-free, enabling local escalation of privilege. The vulnerability is described as requiring no user interaction and enabling exploitation locally, with the Android Widevine DRM component implicated. The linked doc...

CVE-2023-35664

CVE-2023-35664 corresponds to an information-disclosure flaw in Android related to an out-of-bounds read in the ShimConverter.cpp function convertSubgraphFromHAL. The issue arises from a missing bounds check, enabling a local attacker to read sensitive information without additional execution pri...

CVE-2024-31323

CVE-2024-31323 is an Android local elevation-of-privilege vulnerability in the onCreate path of the HealthFitness module (HealthFitness) that could trick a user into granting health permissions via tapjacking, requiring no user interaction for exploitation. The issue is mapped to the Healthfitnes...

CVE-2024-31335

The CVE-2024-31335 entry concerns a logic error in DevmemIntChangeSparse2 within devicemem_server.c that can enable arbitrary code execution with local privilege elevation in the kernel. Connected sources indicate affected components include Android’s kernel-related stack and PowerVR-GPU subcompo...

CVE-2024-34741

The CVE-2024-34741 issue concerns Android’s WindowState.java function setForceHideNonSystemOverlayWindowIfNeeded. A logic error could allow message content to be visible on the screensaver when lock-screen visibility is restricted, enabling local elevation of privilege with no extra execution pri...

CVE-2024-43077

CVE-2024-43077 : Affects Google Android via the DevmemValidateFlags function in devicemem_server.c. The vulnerability is described as an out-of-bounds write caused by memory corruption, enabling local escalation of privilege with no additional execution privileges and no user interaction required...

CVE-2015-8944

CVE-2015-8944 concerns the Linux kernel up to version 4.7 (as used in Android on Nexus 6/7 devices before 2016-08-05). The ioresources_init function in kernel/resource.c uses weak permissions for /proc/iomem, allowing local users to read this file and obtain sensitive information. The description...

CVE-2018-9489

CVE-2018-9489 affects Android where, upon wifi state changes, WifiStateMachine.sendNetworkStateChangeBroadcast broadcasts an intent that includes detailed wifi network information. The root cause is information disclosure via system broadcasts that do not require execution privileges or user inte...

CVE-2020-0245

CVE-2020-0245 is a Media Framework issue in Android (DecodeFrameCombinedMode in combined_decode.cpp) causing a heap-based out-of-bounds write that could disclose information remotely. Affected Android versions include 8.0, 8.1, 9, 10, and 11. The CVSS vectors indicate high severity with network a...

CVE-2020-0383

CVE-2020-0383 affects Android Media Framework (Parse_ins in eas_mdls.c). The issue is an out-of-bounds write due to a missing bounds check, enabling remote information disclosure in the media extractor process with no extra execution privileges required. Impact is shown as partial confidentiality...

CVE-2020-0424

CVE-2020-0424 is an Android System vulnerability where an out-of-bounds read in res_send.cpp (send_vc) can disclose local information due to an incorrect bounds check. Affected: Android-11, Android-9, Android-10. Impact: information disclosure with no extra privileges or user interaction required...

CVE-2021-0579

CVE-2021-0579 affects the Android WiFi driver. The issue is an out‑of‑bounds read caused by a missing bounds check, enabling remote information disclosure to a proximal attacker with no additional privileges and no user interaction required. This is the concrete vulnerability detail reported acro...

CVE-2021-0587

CVE-2021-0587 affects Android’s Media Framework. The issue involves an out-of-bounds write via a use-after-free in the media path (StreamOut.cpp), enabling local escalation of privilege with no user interaction required. Vulnerable Android versions include 8.1–11; the Android Security Bulletin in...

CVE-2021-0639

CVE-2021-0639 affects Android/Widevine through libl3oemcrypto.cpp. Described as a local information disclosure due to weaknesses in the obfuscation/handling of sensitive data; requires no user interaction. Documented impact is partial confidentiality loss with local access and no privileges beyon...

CVE-2021-0696

CVE-2021-0696 describes a use-after-free race in dllist_remove_node (TBD) leading to local privilege escalation on Android SoC. Connected records corroborate a race condition in dllist_remove_node with local-privilege escalation, affecting Android components (PowerVR-GPU listed in PT-2022-9122) a...

CVE-2022-20153

Summary (CVE-2022-20153) In the Android kernel, the vulnerability occurs in the function rcu_cblist_dequeue of rcu_segcblist.c , where improper locking can cause a use-after-free. This can enable local escalation of privilege with SYSTEM execution privileges required, and exploitation does not re...

CVE-2022-20216

CVE-2022-20216 concerns an Android risk where the exported attribute is used to grant third‑party app access permissions; the default intent-filter is true and com.sprd.firewall has set exported to true. The vulnerability is tied to Android devices with a vulnerable Telephony/OSC component (Andro...

CVE-2022-32602

CVE-2022-32602 is described as an out-of-bounds read in the Mediatek keyinstall component caused by a missing bounds check. This could lead to local information disclosure with no authentication or user interaction required. The CVSS data indicates a LOCAL attack vector, LOW privileges, and HIGH ...

CVE-2023-20957

CVE-2023-20957 describes a possible bypass of Factory Reset Protections in Android via the onAttach method of SettingsPreferenceFragment.java, caused by a confused deputy. The impact is local elevation of privilege with no extra execution privileges required, and exploitation is described as requ...

CVE-2023-21091

The CVE-2023-21091 entry affects Android 13 and involves the canDisplayLocalUi path in AppLocalePickerActivity.java. The underlying issue is a missing permission check that could allow changing system app locales, enabling a local denial of service across user boundaries. Exploitation is describe...

CVE-2023-21141

CVE-2023-21141 affects Android 11–13 and is linked to a permissions bypass that allows access to developer mode traces, enabling local information disclosure without additional execution privileges. The vulnerability is described as an information disclosure (ID) issue with local attack vector an...

CVE-2024-25990

The CVE-2024-25990 issue affects the Google Pixel Android stack described in multiple sources: the function pktproc_perftest_gen_rx_packet_sktbuf_mode in link_rx_pktproc.c experiences an out-of-bounds write due to a race condition. This vulnerability is claimed to permit local escalation of privi...

CVE-2024-34723

Summary: CVE-2024-34723 describes a logic error in Android’s ParcelableListBinder.java (onTransact) that could enable local elevation of privilege by stealing the mAllowlistToken to launch an app from the background, without extra privileges or user interaction. The vulnerability is tied to how P...

CVE-2024-40658

CVE-2024-40658 affects the Android Framework: the vulnerability is in getConfig of SoftVideoDecoderOMXComponent.cpp, causing a heap buffer overflow that can produce an out-of-bounds write. Impact is local escalation of privilege with no additional execution privileges or user interaction required...

CVE-2020-0394

CVE-2020-0394 describes a tapjacking vulnerability in Android’s BluetoothPairingDialog.java, triggered in onCreate, due to an insecure default value. Affects Android 8.0–11; impact is local elevation of privilege with untrusted devices potentially accessing contact lists, requiring user interacti...

CVE-2020-0412

CVE-2020-0412 affects Android where in setProcessMemoryTrimLevel of ActivityManagerService.java a missing permission check could allow local information disclosure of foreground processes without extra privileges. Affected Android versions include 8.0–11 (Android-8.0/8.1/9/10/11). The issue is cl...

CVE-2020-0464

CVE-2020-0464 affects Android 10; in resolv_cache_lookup (res_cache.cpp) a side-channel enables local information disclosure of accessed web resources without extra privileges or user interaction. The Android Security Bulletin lists this as a High‑impact, local vulnerability with CVSS v3.1 base s...

CVE-2020-0471

CVE-2020-0471 in Android concerns a flaw in reassemble_and_dispatch of packet_fragmenter.cc that could allow injecting packets into an encrypted Bluetooth connection due to improper input validation. This enables remote escalation of privilege between two Bluetooth devices by a proximal attacker ...

CVE-2021-0399

Summary: CVE-2021-0399 is a memory corruption use-after-free in Android kernel’s xt_qtaguid.c (qtaguid_untag). The issue can lead to local escalation of privilege with no extra execution privileges or user interaction. The vulnerable component is the kernel’s qtaguid path; exploitation is local, ...

CVE-2021-0433

CVE-2021-0433 affects Android 8.1–11. The issue is a tapjacking/overlay bypass in DeviceChooserActivity.java that lets an attacker bypass the consent dialog when pairing a Bluetooth device, enabling local escalation of privilege and pairing with a malicious device without extra privileges. Exploi...

CVE-2021-0520

CVE-2021-0520 describes a use-after-free due to a race condition in MemoryFileSystem.cpp and related files, enabling local escalation of privilege with no additional execution privileges or user interaction. Affected: Android (Android-11 and Android-10 per the Initial document). The vulnerability...

CVE-2021-0682

CVE-2021-0682 affects Android via a permissions check gap in NotificationManagerService.java (sendAccessibilityEvent), enabling local information disclosure of notifications. Affected: Android 8.1, 9, 10, 11. Exploitation: local, requires no user interaction, per description; no mitigation detail...

CVE-2021-0953

CVE-2021-0953 affects Android 9–12. The issue is in SearchWidgetProvider.setOnClickActivityIntent, where an unsafe PendingIntent could allow access to contacts and history bookmarks without permission, enabling local privilege escalation with no user interaction required. Android patch levels 202...

CVE-2021-39622

CVE-2021-39622 affects Google GBoard on Android 10–12, where a missing permission check allows bypassing Factory Reset Protection, enabling local elevation of privilege without user interaction. The NVD entry lists the impact as local privilege escalation with complete confidentiality/integrity/a...

CVE-2021-39625

CVE-2021-39625 affects Android (versions 9–12) and is tied to EuiccNotificationManager.java in showCarrierAppInstallationNotification, where an unsafe PendingIntent could allow a local attacker to access MediaProvider content and escalate privileges. The underlying issue is a local elevation of p...

CVE-2022-20417

CVE-2022-20417 describes an out-of-bounds write in the Android framework: in audioTransportsToHal of HidlUtils.cpp, caused by an incorrect bounds check, enabling local elevation of privilege with no user interaction. Affected: Android 12, 12L, and 13. The connected documents do not provide a conc...

CVE-2023-20780

The CVE-2023-20780 entry concerns MediaTek/MVK keyinstall: a missing bounds check in the keyinstall module can cause local information disclosure, requiring System privileges with no user interaction. Affected component is the keyinstall path; impact is local information disclosure with potential...

CVE-2023-21144

The CVE-2023-21144 entry affects Android 11–13 and involves a DoInBackground() path in NotificationContentInflater.java. The vulnerability is a temporary denial of service caused by long-running operations, enabling remote DoS without extra privileges or user interaction. The Red Hat/CNVD/PRION/N...

CVE-2023-40081

The CVE-2023-40081 entry describes an information-disclosure flaw in Android: in loadMediaDataInBgForResumption inside MediaDataManager.kt, a confused-deputy allows viewing another user’s images (no extra execution privileges, no user interaction required). Several connected advisories confirm th...

CVE-2023-40090

What’s affected: Google Android platform vulnerability CVE-2023-40090 in the Bluetooth stack, specifically BTM_BleVerifySignature in btm_ble.cc. The issue is described as bypassing signature validation via side-channel information disclosure, enabling remote escalation of privilege with no additi...

CVE-2023-45774

CVE-2023-45774 affects the Android Shortcuts framework: In fixUpIncomingShortcutInfo of ShortcutService.java, an attacker could view another user’s image due to a confused deputy, enabling local elevation of privilege with no user interaction. Exploitation status is not detailed in the provided d...