CVE-2021-0574

The vulnerability CVE-2021-0574 affects the asf extractor in Android (MediaTek components) where an out-of-bounds write occurs due to a missing bounds check. This can lead to local elevation of privilege with no user interaction required; exploitation details are not provided in the documents. Re...

CVE-2021-0644

CVE-2021-0644 concerns an information disclosure in Android 10/11. In SubscriptionController.java, the function conditionalRemoveIdentifiers allows retrieval of a trackable identifier due to a missing permission check, enabling local information disclosure with user privileges. Exploitation requi...

CVE-2021-0705

CVE-2021-0705 concerns the Android Framework component, specifically in sanitizeSbn of NotificationManagerService.java. The connected documents describe a vulnerability where an attacker could bypass Background Service Restrictions to keep a service running in the foreground while retaining grant...

CVE-2021-39660

Technical details about CVE-2021-39660 are not provided in the supplied documents. The materials reference an Android kernel race condition with local privilege escalation but no specifics on affected product versions or fixes. Monitor for updates.

CVE-2021-39734

CVE-2021-39734 is an Elevation of Privilege in Google Android telephony logic related to RCS messaging. The issue is described as stemming from a missing permission check in OneToOneChatImpl.java that could allow sending an RCS message without required permissions, enabling local privilege escala...

CVE-2021-39814

CVE-2021-39814 affects Android kernel: in ppmp_validate_wsm of drm_fw.c there is an out-of-bounds write caused by an incorrect bounds check, enabling local privilege escalation with System execution privileges required and no user interaction. Documents indicate a local attack with high impact (C...

CVE-2022-20121

CVE-2022-20121 describes an information-disclosure vulnerability in Android related to the USCCDMPlugin/USCCDMService. The root cause is a missing permission check in getNodeValue of USCCDMPlugin.java, enabling local disclosure of ICCID with no extra execution privileges and without user interact...

CVE-2022-20387

CVE-2022-20387 is listed in multiple sources as affecting Android on Unisoc Android SoC components. A connected Prion entry explicitly labels it as a “Code injection” issue, while the NVD/NVD-derived summaries indicate Android SoC/Android as the affected context with high-severity implications in...

CVE-2022-23426

Samsung DeX Home (and DeX for PC) prior to SMR Feb-2022 Release 1 contains a vulnerability that uses PendingIntent to access files with system privileges. This is a local privilege escalation with partial confidentiality/integrity impact per the sources. There are no exploit details provided in t...

CVE-2022-32594

CVE-2022-32594 concerns the Widevine component with an out-of-bounds write caused by an incorrect bounds check. Reported impact is local escalation of privileges requiring System execution privileges, with no user interaction needed. Connected sources confirm a patch exists (ALPS07446207/ALPS0744...

CVE-2022-32598

CVE-2022-32598 affects the Widevine component, where an incorrect bounds check can cause an out-of-bounds write. This enables local escalation to SYSTEM privileges with no user interaction required. A patch/mitigation reference is PATCH ID: ALPS07446228 (Issue ALPS07446228); no further product/ve...

CVE-2022-39134

CVE-2022-39134 is described in the sources as a use-after-free vulnerability caused by a race condition in the audio driver, leading to local denial of service in the kernel. Public documents confirm the issue exists and affect kernel/audio pathways, with a CVSS v3.1 score of 4.7 (Medium) reflect...

CVE-2022-44436

CVE-2022-44436 describes a missing permission check in the Android messaging service, enabling a local denial-of-service in the contacts service with no extra execution privileges required. Root cause: permission verification gap in the messaging component. Impact: local DoS; no remote code execu...

CVE-2023-21240

Technical details are not publicly available in the provided connected documents. CVE-2023-21240 is described as a boot loop/resource exhaustion DoS in Policy.java with no exploitation vectors, affected versions, or fixes disclosed here.

CVE-2023-3781

CVE-2023-3781 describes a use-after-free write from improper locking in a kernel component, enabling local elevation of privilege without user interaction. The threat is local access required (attack vector LOCAL) with a high impact on confidentiality, integrity, and availability as per CVSS. The...

CVE-2023-48423

CVE-2023-48423 : The vulnerability is an out-of-bounds write in the function dhcp4_SetPDNAddress of dhcp4_Main.c caused by a missing bounds check. This could enable remote code execution with no additional privileges and without user interaction. Public documents (NVD, OSV) reiterate the same des...

CVE-2024-27233

CVE-2024-27233 affects the ppcfw_init_secpolicy function in ppcfw.c, describing a possible permission bypass caused by uninitialized data that could enable local privilege escalation with no extra privileges and no user interaction. Connected sources (Red Hat, NVD, PRION, CVE listings) corroborat...

CVE-2024-34738

CVE-2024-34738 affects Android’s Framework via AppOpsService.java, enabling unprivileged apps to read their own restrictRead app-op states because of a logic error. This can lead to local elevation of privilege with no extra execution privileges or user interaction required. Connected sources cor...

CVE-2024-34742

The CVE-2024-34742 issue affects Google Android, specifically a logic error in shouldWrite within OwnersData.java that can prevent MDM policies from being persisted, potentially causing a local denial of service without extra privileges. The vulnerability is described across multiple sources (NVD...

CVE-2017-0406

CVE-2017-0406 is a remote code execution vulnerability in Android's Mediaserver (libhevc) that can be triggered by processing a specially crafted media file, leading to memory corruption and potential code execution within the Mediaserver process. Reported impact is critical (CVE-2017-0406) with ...

CVE-2020-0258

CVE-2020-0258 affects Android 10 Framework specifically in AppZygote.java’s stopZygoteLocked path, where insufficient cleanup can lead to local information disclosure by a next-starting application. Exploitation is local and does not require user interaction; no exploit details are provided in th...

CVE-2020-0378

CVE-2020-0378 affects Android System (PasspointManager.java: onWnmFrameReceived) with a missing permission check that could lead to local information disclosure of location data. Underlying cause is an insufficient permission check in a code path handling Passpoint/WLAN Frame processing. Document...

CVE-2020-0413

The CVE-2020-0413 issue affects Android devices (Android 8.0–11) and is caused by a missing bounds check in gatt_process_read_by_type_rsp within gatt_cl.cc, leading to a possible out-of-bounds read that could disclose memory contents via a remote Bluetooth connection without user interaction. The...

CVE-2020-0415

CVE-2020-0415 affects Android’s SystemUI: a permission bypass via an unsafe PendingIntent could enable local information disclosure of contacts with user privileges, requiring no user interaction for exploitation. The vulnerability is listed in the 2020-10 Android security bulletin under System a...

CVE-2020-0417

The CVE-2020-0417 entry describes a local elevation-of-privilege in Android related to GpsNetInitiatedHandler.setNiNotification. The underlying issue is an empty mutable PendingIntent that permits a permissions bypass. Affected Android versions are 8.1, 9, and 10. Exploitation is described as pos...

CVE-2020-0421

CVE-2020-0421 is an Elevation of Privilege vulnerability in the Android Framework (affecting Android 8.0–11) that could allow a locally malicious app to bypass user interaction requirements and gain additional permissions. The root cause is described as an out-of-bounds write in String8.cpp (appe...

CVE-2021-0429

CVE-2021-0429 affects Android and stems from a use-after-free in ALooper.cpp (function pollOnce), causing memory corruption that could enable local escalation of privilege without requiring user interaction. Reported impact notes indicate affected Android versions include Android-9, Android-10, A...

CVE-2021-0598

CVE-2021-0598 refers to an Android vulnerability in ConfirmConnectActivity.java where tapping a dialog could allow a tapjacking/overlay attack to pair with untrusted Bluetooth devices, potentially enabling local privilege escalation. Affected products: Android versions 11, 10, 9, and 8.1. Root ca...

CVE-2021-0602

CVE-2021-0602 affects Android 10 and 11 via WifiNetworkDetailsFragment.onCreateOptionsMenu, enabling guest users to view/modify configured APs due to a permissions bypass. This can cause local elevation of privilege with no extra execution privileges or user interaction. Exploitation details are ...

CVE-2021-0922

CVE-2021-0922 : The Android framework vulnerability resides in PackageManagerService.java, in enforceCrossUserOrProfilePermission, where a missing permission check can bypass INTERACT_ACROSS_PROFILES. This enables local escalation of privilege on Android 11 without user interaction. Documents con...

CVE-2021-0955

CVE-2021-0955 affects Android 11 where the race condition in the function path pf_write_buf within FuseDaemon.cpp can cause memory corruption leading to local elevation of privilege without user interaction. The issue is documented in multiple feeds (NVD/Red Hat/OSV) with the same root cause and ...

CVE-2022-20108

CVE-2022-20108 concerns a vulnerability in the voice service where an out-of-bounds write occurs due to a stack-based buffer overflow. The consequence is local escalation of privilege to System level, with no user interaction required for exploitation. Public details consistently describe this as...

CVE-2022-20158

CVE-2022-20158 affects the Android kernel in the backing-dev.c component (bdi_put and bdi_unregister). The issue is a use-after-free leading to memory corruption, with the documented impact of local privilege escalation to SYSTEM level. Exploitation is described as local (AV:L, UI:N) with no user...

CVE-2022-20435

CVE-2022-20435 is an Android vulnerability described as an unauthorized service in the system service that, due to missing permission checks, can lead to local elevation of privilege and potentially a system reboot. Connected OSV entries (ASB-A-242248367 and ASB-A-242248369) corroborate an unauth...

CVE-2022-20440

CVE-2022-20440 affects Android’s Messaging component, where an unauthorized broadcast could lead to a Local Denial of Service. The issue is documented across multiple feeds (NVD/RH/NCSC/PT-PCI/etc.) with no specific exploit details provided in these excerpts. The Android Security Bulletin outline...

CVE-2022-38690

CVE-2022-38690: In the kernel camera driver, a memory corruption can occur due to improper locking, leading to local denial of service. This is described across multiple sources (NVD/OSV-like entries and PRION) and is specifically tied to the camera driver component; no exploitation details or pa...

CVE-2022-47488

CVE-2022-47488 affects the spipe drive component in Unisoc chipsets, with an out-of-bounds write caused by a missing bounds check that could enable local DoS with system execution privileges. The connected documents confirm the issue but provide no publicly available fix/version details; some sou...

CVE-2023-20829

The CVE-2023-20829 issue affects the gps component in MediaTek-based devices, caused by a missing bounds check that enables an out-of-bounds write. This can lead to local privilege escalation to SYSTEM with no user interaction required, per the description. Reported under various feeds (NVD, Red ...

CVE-2023-21342

CVE-2023-21342 is an Android framework issue in RemoteSpeechRecognitionService that enables launching an activity from the background due to a logic error. This causes local elevation of privilege with no additional privileges or user interaction required. The CVSS vector (LOCAL, LOW attack compl...

CVE-2024-27221

CVE-2024-27221 describes an out-of-bounds write in the update_policy_data function caused by a missing bounds check, enabling local elevation of privilege without user interaction. Public references in the connected documents point to Google Pixel as affected, with the issue categorized as EoP an...

CVE-2024-27224

CVE-2024-27224 is an out-of-bounds write in strncpy.c (strncpy), causing local elevation of privilege due to a missing bounds check. Documented as an EoP issue affecting Google Pixel components (Little Kernel) with exploitation details not provided in the supplied sources. The vulnerability is li...

CVE-2024-29757

The CVE-2024-29757 vulnerability is an Elevation of Privilege issue in Google Android Pixel firmware, caused by whitelisting of debugging certificates. Affected component (Pixel Companion) can bypass certain permissions, enabling local escalation of privilege without additional execution privileg...

CVE-2024-40671

CVE-2024-40671 affects DevmemIntChangeSparse2 in devicemem_server.c, with a missing permission check that could enable arbitrary code execution and local privilege escalation without user interaction. Public entries across multiple feeds (NVD, Red Hat, Vuln enrichment, and OSV) consistently descr...

CVE-2020-0248

CVE-2020-0248 is an information-disclosure vulnerability in Android 10 involving the InstantAppNotifier’s postInstantAppNotif path. The root cause is a PendingIntent handling error that enables a local attacker to bypass permissions, leading to local information disclosure without user interactio...

CVE-2020-0468

CVE-2020-0468 affects Android’s TelephonyRegistry.java, where a missing permission check allows a local bypass of location permissions, enabling local information disclosure with no user interaction. Multiple connected sources (NVD entry, Red Hat advisory RH:CVE-2020-0468, OSV listing ASB-A-15848...

CVE-2021-0390

CVE-2021-0390 is described as a local elevation-of-privilege issue in Android arising from a missing permission check in multiple methods of WifiNetworkSuggestionsManager.java. The flaw could allow a background user on the same device, with no additional execution privileges, to modify the set of...

CVE-2021-0436

CVE-2021-0436: In CryptoPlugin::decrypt (CryptoPlugin.cpp) on Android, there is a possible out-of-bounds read caused by integer overflow, potentially leading to local information disclosure without extra privileges. Affected: Android devices (Android-8.1, 9, 10, 11). Impact is information disclos...

CVE-2021-0444

CVE-2021-0444 affects Android devices (Android-11, Android-8.1, Android-9, Android-10). In QuickContactActivity.java, onActivityResult returns an extra Intent unnecessarily, leading to local information disclosure of contact data without elevated privileges. Exploitation requires user interaction...

CVE-2021-0446

CVE-2021-0446 affects Android 11, specifically the ImportVCardActivity. The vulnerability allows bypassing user consent via a tapjacking/overlay attack, enabling local escalation of privilege with user-execution privileges needed. The exploit requires user interaction. Root cause is an overlay-ba...

CVE-2021-0466

CVE-2021-0466 is an Android 10 information-disclosure vulnerability. It resides in startIpClient of ClientModeImpl.java and could expose a device identifier to a proximal attacker without remote code execution or user interaction. The Red Hat and NVD entries confirm the issue affects Android 10 a...