CVE-2024-20011

The CVE-2024-20011 issue affects MediaTek’s alac decoder, caused by an incorrect bounds check that enables information disclosure and could lead to remote code execution without user interaction. The vulnerability is rated high/critical with network access and no privileges required. A patch is r...

CVE-2024-20057

CVE-2024-20057 is a MediaTek keyInstall vulnerability caused by a missing bounds check that enables an out-of-bounds write, potentially leading to local privilege escalation with SYSTEM privileges. Exploitation is reported as not requiring user interaction. The issue is associated with MediaTek r...

CVE-2024-20141

MediaTek MT8893 V5 DA module (MediaTek DA) contains an out-of-bounds write due to a missing bounds check, enabling local privilege escalation with physical access. Exploitation requires user interaction; no remote/vector details provided. Patch ALPS09291402 (MSV-2073) addresses this issue. Refere...

CVE-2024-23697

CVE-2024-23697: A use-after-free in RGXCreateHWRTData_aux (rgxta3d.c) enables possible arbitrary code execution and local kernel privilege escalation. No user interaction required. Documents consistently describe this as a local-privilege escalation vulnerability with kernel impact and do not pro...

CVE-2024-23716

In CVE-2024-23716, a race condition in DevmemIntPFNotify within devicemem_server.c can trigger a use-after-free, enabling local privilege escalation in the kernel with no extra execution privileges or user interaction required. The linked Red Hat and Android bulletin data corroborate a kernel-lev...

CVE-2024-27226

CVE-2024-27226 describes an out-of-bounds write in tmu_config_gov_params, caused by a missing bounds check. The vulnerability allows local privilege escalation with no additional privileges or user interaction required. Public references/entries across multiple sources (NVD, Red Hat, CVE list, OS...

CVE-2024-27229

CVE-2024-27229 describes a null pointer dereference in ss_SendCallBarringPwdRequiredIndMsg within ss_CallBarring.c, leading to remote denial of service without user interaction. The vulnerability is tracked in Android/Pixel advisories and is listed in the Pixel March 2024 update bulletin with DoS...

CVE-2024-27234

CVE-2024-27234 describes an out-of-bounds read in the function family 'fvp_set_target' in fvp.c due to a missing bounds check. This leads to potential local information disclosure without extra execution privileges or user interaction. The provided documents do not specify affected product versio...

CVE-2024-27237

CVE-2024-27237 involves a logic error in wipe_ns_memory() within nsmemwipe.c that can cause an incorrect size calculation. This flaw permits local information disclosure without requiring elevated privileges or user interaction. The vulnerability is described across multiple sources (NVD/Red Hat/...

CVE-2024-40651

CVE-2024-40651 describes a possible local escalation of privilege in the Android kernel stemming from a use-after-free caused by a logic error (exact component not disclosed in provided documents). The vulnerability, as described across multiple sources, can be exploited with local access and doe...

CVE-2024-40654

CVE-2024-40654 is an Android issue described across multiple sources as a privilege bypass (confused deputy) that could enable local escalation of privilege. Exploitation is noted to require user interaction in at least one description, with impact described as high (confidentiality, integrity, a...

CVE-2025-31710

CVE-2025-31710 describes a local command-injection vulnerability in the engineermode service (com.sprd.engineermode) that enables privilege escalation via improper input validation. Connected sources tie this to Doogee Note59/Note59 Pro/Note59 Pro+ devices, where an attacker with local access can...

CVE-2017-13216

CVE-2017-13216 affects Android kernel ashmem: in ashmem_ioctl, an out-of-bounds write occurs due to insufficient locking when accessing asma. This can enable local privilege escalation and code execution within a privileged process, with no user interaction required. Public advisories describe th...

CVE-2020-0239

CVE-2020-0239 affects the Android Framework (DocumentsContract.java) and describes a permissions bypass that can disclose location metadata from files (e.g., photos) via a local information disclosure flaw. The vulnerability is rooted in getDocumentMetadata, enabling a local attacker to access lo...

CVE-2020-0257

CVE-2020-0257 affects Android 10 Framework: In SpecializeCommon of com_android_internal_os_Zygote.cpp there is a permissions bypass caused by incomplete cleanup, enabling local elevation of privilege in isolated processes without extra execution privileges. Exploitation is local and does not requ...

CVE-2020-0390

CVE-2020-0390 affects Android where the zygote SE Policy has a permissions bypass, enabling local information disclosure without extra privileges. Affected: Android-10 and Android-11, with the issue categorized as an Information Disclosure (ID) vulnerability in the Framework/zygote policy. Impact...

CVE-2020-0392

CVE-2020-0392 is a concrete vulnerability in the Android SurfaceFlinger component. The issue arises in getLayerDebugInfo of SurfaceFlinger.cpp, where a double free can occur, enabling a local escalation of privilege with no additional execution privileges required. Affected: Android 9, 10, and 11...

CVE-2020-0395

CVE-2020-0395 affects Google/Android platforms (Android 8.0–11) in the EmergencyCallbackModeService.showNotification path. The root cause is an unsafe PendingIntent that enables a possible permission bypass, leading to local information disclosure under user privileges without user interaction. A...

CVE-2020-0407

The CVE-2020-0407 entry concerns Android kernel/F2FS encryption where hardware that supports only 32-bit IVs leads to truncation to 32 bits for 64-bit IVs in certain implementations. This IV truncation can cause IV reuse, weakening disk encryption and potentially enabling local information disclo...

CVE-2020-0451

CVE-2020-0451 is a vulnerability in Android’s Media Framework (sbrdecoder.cpp, sbrDecoder_AssignQmfChannels2SbrChannels) where a heap buffer overflow can cause an out-of-bounds write, enabling remote code execution with high impact. Exploitation requires user interaction. Affected Android version...

CVE-2021-0649

CVE-2021-0649 affects Android 11: In Vpn.java’s stopVpnProfile, there is a permissions bypass leading to a possible VPN profile reset and local elevation of privilege (CONTROL_ALWAYS_ON_VPN) with no user interaction. The issue is classified as a local elevation of privilege; patches are reference...

CVE-2021-0697

CVE-2021-0697 is a race-condition vulnerability in the PVRSRVRGXSubmitTransferKM path of rgxtransfer.c (PowerVR GPU) on Android SoCs. It enables a possible user-after-free leading to local escalation of privilege with no additional execution privileges required and no user interaction. Exploit st...

CVE-2021-0921

CVE-2021-0921 is a Android 11 elevation-of-privilege issue in ParsingPackageImpl.java caused by an input validation mismatch during parcel serialization/deserialization. The vulnerability enables local attackers to gain additional privileges with no user interaction required. Multiple connected s...

CVE-2021-39656

CVE-2021-39656 affects the Linux kernel used by Android. A use-after-free in __configfs_open_file (file.c) arises from improper locking, enabling local privilege escalation with kernel execution privileges; no user interaction is required. The vulnerability is documented in upstream kernel refere...

CVE-2021-39749

CVE-2021-39749 affects Android 12L WindowManager; it allows starting non-exported/protected activities due to a missing permission check, enabling local privilege escalation with no additional privileges and no user interaction. A PoC demonstrates cross-app activity startup via TaskFragment/Choos...

CVE-2022-38669

CVE-2022-38669 describes a privilege-escalation issue in the soundrecorder service that lacks a required permission check, enabling elevation of privilege in the contacts service without extra execution privileges. Multiple sources (NVD, Red Hat, OSV) corroborate the core flaw and its local attac...

CVE-2022-44426

CVE-2022-44426 describes a local denial-of-service condition due to a missing bounds check in the WLAN driver. The primary impact is local DoS in WLAN services; exploitation details are not provided in the sources. CVSSv3.1 metrics from the NVD indicate a base score of 5.5 (Medium) with LOCAL acc...

CVE-2022-44430

CVE-2022-44430 describes a possible missing bounds check in the wlan driver, enabling a local denial of service in wlan services. Public records map this issue to Unisoc/Android WLAN components, with a CVSS v3.1 base score of 5.5 (Attack Vector: Local; Privileges Required: Low; User Interaction: ...

CVE-2023-32834

CVE-2023-32834 describes a memory corruption due to a type confusion in the secmem module, potentially enabling local privilege escalation to SYSTEM. The entry is associated with MediaTek ALPS (ALPS08161762 patch/issue IDs). The vulnerability is reported as exploitable without user interaction, w...

CVE-2023-40103

CVE-2023-40103 affects Android Framework components and is caused by a double free leading to memory corruption. The vulnerability enables local elevation of privilege with no user interaction. According to the Android December 2023 bulletin, CVE-2023-40103 is addressed in the Framework with upda...

CVE-2023-48350

CVE-2023-48350 describes a vulnerability in the video decoder where a missing bounds check can lead to an out-of-bounds write, resulting in local denial of service without additional privileges. The issue is consistently reported across sources (NVD/Red Hat/PRION/VulnEnrichment/CVE lists), all id...

CVE-2024-22006

CVE-2024-22006 describes an out-of-bounds read in the TMU plugin that enables memory disclosure within the device’s power-management subsystem. Public sources list this as an information disclosure-type vulnerability with a CVSSv3.1 base score of 5.3 (Network attack vector, Low confidentiality im...

CVE-2024-34721

CVE-2024-34721 describes an information-disclosure in Android’s MediaProvider.java, in ensureFileColumns, where improper input validation may allow a user to disclose files owned by another user. This is a local disclosure with no extra execution privileges required and does not require user inte...

CVE-2024-34730

CVE-2024-34730 describes a logic error in multiple locations that allows bypassing user consent to enable new Bluetooth HID devices, leading to local elevation of privilege with no additional execution privileges or user interaction required. Connected sources consistently state the impact as loc...

CVE-2020-0019

CVE-2020-0019 affects Broadcom Nexus firmware in Android SoCs, where an insecure default password may allow local information disclosure in the kernel without extra privileges or user interaction. Exploitation is local; impact is confidentiality loss as described by CVSS metrics. The available do...

CVE-2020-0096

CVE-2020-0096 is an Android local privilege-escalation (StrandHogg 2.0) rooted in startActivities of ActivityStartController.java. The flaw allows a confused deputy to execute code with a privileged context on Android 8.0–9.0, with no user interaction required. Affected products/versions are Andr...

CVE-2020-0438

CVE-2020-0438 affects Android via the AIBinder_Class constructor in ibinder.cpp (libbinder_ndk). It enables potential arbitrary code execution and local privilege escalation without user interaction, when a vulnerable process uses the component. Documented impact includes local escalation of priv...

CVE-2020-0450

CVE-2020-0450 affects Android via rw_i93_sm_format in rw_i93.cc, where an out-of-bounds read can arise from uninitialized data. This could enable remote information disclosure over NFC with no additional execution privileges; exploitation requires user interaction. Affected Android versions inclu...

CVE-2020-0457

CVE-2020-0457 is an out-of-bounds write due to a missing bounds check affecting Android devices, with a specific association to MediaTek components (vcu) in the 2020 Android security bulletin set. Connected sources indicate the issue is documented across NVD, Red Hat, CVE records, and OSV entries...

CVE-2020-0460

CVE-2020-0460 affects Android 11, in CertInstaller.java (createNameCredentialDialog). Root cause: a logic error that can improperly install certificates, leading to remote information disclosure with no privileges and no user interaction required. Public details come from Android 2020-12-01/12-05...

CVE-2021-0439

CVE-2021-0439 affects Android 11 and is tied to a vulnerability in setPowerModeWithHandle in com_android_server_power_PowerManagerService.cpp. The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege with no additional execution privileges and w...

CVE-2021-0445

CVE-2021-0445 affects Android 9 and 11 (WelcomeActivity.java) where a mismanaged profile in the Welcome flow introduces a confused deputy, enabling local escalation of privilege without extra execution privileges or user interaction. The issue is a residual profile condition in Startup/Welc ome f...

CVE-2021-0881

CVE-2021-0881 describes an integer overflow in the PowerVR kernel driver component PVRSRVBridgeRGXKickCDM that occurs due to a missing size check. This can enable out-of-bounds heap access and lead to local escalation of privilege without extra execution privileges or user interaction. The vulner...

CVE-2021-0923

CVE-2021-0923 affects Google Android 12, described as an elevation of privilege in Framework: in Permission.java createOrUpdate there is a missing permission check that could allow a local attacker to gain internal permissions without additional execution privileges and without user interaction. ...

CVE-2021-39636

CVE-2021-39636 is a local information-disclosure vulnerability in the Linux kernel's ip_tables.c (do_ipt_get_ctl/do_ipt_set_ctl) that can leak uninitialized kernel data. Android kernel also implicated in the description. The issue enables local information disclosure with system execution privile...

CVE-2021-39806

CVE-2021-39806 affects Android 12L, with a memory corruption risk due to a double free in closef of label_backends_android.c. The issue could enable local escalation of privilege during servicemanager startup if an initialization failure is triggered, with no additional execution privileges requi...

CVE-2022-20149

CVE-2022-20149 is listed in the Pixel Update Bulletin as a Modem-component vulnerability with Type: ID (information disclosure) and Moderate severity. The connected Pixel bulletin entry confirms the issue is mapped to the Modem and labeled as an information-disclosure (ID) vulnerability, but does...

CVE-2022-20389

CVE-2022-20389 is tied to Android SoC/Unisoc components. The connected documents specify affected areas as Android SoC and Unisoc Android components, with a high severity rating (CVE-2022-20389) and no publicly disclosed exploit details in the provided sources. There are no vendor/product version...

CVE-2022-38672

CVE-2022-38672 affects the face detect driver and involves a missing bounds check that enables a local out-of-bounds write. This can lead to local denial of service in the kernel. Connected documents (OSV/NVD) confirm the same description; no exploit details, affected firmware versions, or patche...

CVE-2022-48455

CVE-2022-48455 is a local vulnerability described as a possible out-of-bounds write in the wifi service due to a missing bounds check, leading to local denial of service without extra privileges. The primary sources (NVD/NVD-derived entries) show a CVSS v3.1 base score of 5.5 (Medium) with Local ...