CVE-2022-21743

CVE-2022-21743 affects the component referenced as ion , where an integer overflow can trigger a use-after-free vulnerability. This leads to potential local privilege escalation without requiring additional execution privileges or user interaction (per the provided descriptions). The issue is doc...

CVE-2022-38673

CVE-2022-38673 affects the face detect driver and relates to an out-of-bounds write caused by a missing bounds check. The impact stated across the provided sources is local denial of service in kernel space. The connected documents (Red Hat, OSV, NVD, etc.) consistently describe the same issue bu...

CVE-2022-42520

CVE-2022-42520: Use-after-free in Android’s ServiceInterface::HandleRequest (serviceinterface.cpp) can lead to local escalation of privilege to system level. Affected component: Android kernel/service interface; exploitation described as LOCAL with HIGH privileges required and no user interaction...

CVE-2022-47462

CVE-2022-47462 involves a missing permission check in the telephone service, enabling local escalation of privilege to system execution privileges. Public sources corroborate a vulnerability in the telephony stack (com.android.phone/system) with a Local attack vector and high impact on confidenti...

CVE-2023-20653

MediaTek CVE-2023-20653 describes an out-of-bounds write in the keyinstall component due to a missing bounds check, enabling local escalation of privilege with System execution privileges required and no user interaction. The issue is tied to the patch ALPS07628168 (Issue ALPS07589144). Exploitat...

CVE-2023-32835

CVE-2023-32835 affects MediaTek devices, specifically the keyinstall module. The issue is a memory corruption due to a type confusion vulnerability, leading to local elevation of privilege with System execution privileges needed. Exploitation requires no user interaction per the initial descripti...

CVE-2024-22009

CVE-2024-22009 is an out-of-bounds write in the init_data function causing local privilege escalation with no user interaction required. Documented impact is high (CVE affects Google Pixel ACPM path; exploit would grant elevated privileges locally). Root cause: missing bounds check leading to an ...

CVE-2024-40657

CVE-2024-40657 affects the Android Framework, specifically the AccountTypePreferenceLoader.addPreferencesForType path. The issue can enable a confused deputy to disable apps for other users, causing local elevation of privilege with no extra execution privileges required and no user interaction n...

CVE-2024-43081

The CVE-2024-43081 issue affects Google Android and is tied to the function installExistingPackageAsUser in InstallPackageHelper.java. The root cause is a logic error that allows a carrier restriction bypass, enabling local elevation of privilege with no extra execution privileges and no user int...

CVE-2025-48633

CVE-2025-48633 concerns a logic error in Android Framework related to DevicePolicyManagerService.hasAccountsOnAnyUser, enabling a local attacker to add a Device Owner after provisioning and escalate privileges without user interaction. Connected sources (EUVD-2025-201737; Android Security Bulleti...

CVE-2019-2011

CVE-2019-2011 affects Android 8.0–9, with a vulnerable code path in Parcel.cpp: readNullableNativeHandleNoDup, where a missing bounds check can cause an out-of-bounds write. This yields local escalation of privilege with no extra privileges or user interaction required. Impact is described as EoP...

CVE-2020-0294

CVE-2020-0294 affects Android; in WallpaperManagerService.bindWallpaperComponentLocked there is a permission bypass caused by an unsafe PendingIntent. The issue allows local elevation of privilege with user privileges required, and does not require user interaction. Affected Android versions incl...

CVE-2020-0433

CVE-2020-0433 affects the Android/Linux kernel: use-after-free in blk_mq_queue_tag_busy_iter (blk-mq-tag.c) caused by improper locking, enabling local privilege escalation with no user interaction. Public details in the Initial document describe the flaw; connected Nessus advisories (Unity Linux/...

CVE-2022-20151

CVE-2022-20151 is listed in Pixel security patches as an Information Disclosure (Type: ID) affecting the Modem component on Google Pixel devices. The Android bug ID associated is A-210712565. Public sources also flag it as related to the Android kernel in the CVE context, with no explicit exploit...

CVE-2022-20171

CVE-2022-20171 is a Critical remote code execution vulnerability affecting Google Pixel modem components, disclosed in the Pixel Update Bulletin (June 2022). The NVD entry lists CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-based exploitation with no user interaction could co...

CVE-2022-20400

CVE-2022-20400 affects Android kernel code, specifically the cd_CodeMsg path in cd_codec.c, where a missing bounds check can cause an out-of-bounds write. This leads to remote code execution with no privileges required and no user interaction, as indicated by the description and NVD metrics (CVSS...

CVE-2022-20427

CVE-2022-20427 affects the Android kernel and is tied to memory corruption caused by improper input validation, leading to local escalation of privilege with high impact on confidentiality, integrity, and availability. Exploitation is described as local with no user interaction required; details ...

CVE-2022-22272

CVE-2022-22272 affects TelephonyManager in Samsung/Android prior to the SMR Jan-2022 Release 1. The issue is improper authorization that allows an attacker to obtain the IMSI without READ_PRIVILEGED_PHONE_STATE permission. Root cause is insufficient access control in TelephonyManager’s handling o...

CVE-2022-38670

The CVE-2022-38670 entry describes a vulnerability in the soundrecorder service caused by a missing permission check, potentially enabling local elevation of privilege in the contacts service without requiring additional execution privileges. Connected documents (RH/CVE, NVD, OSV entries) confirm...

CVE-2022-39132

CVE-2022-39132 describes a probable out-of-bounds write in the kernel camera driver caused by a missing bounds check, enabling a local denial of service. The affected component is the camera driver; the root cause is an unchecked input/buffer access leading to memory write beyond bounds. The impa...

CVE-2022-48391

CVE-2022-48391 describes a missing permission check in the telephony service, leading to a local Denial of Service with no additional execution privileges. Connected sources reference Android/Unisoc components and related CVE mappings, but no explicit affected versions, vendor details, or availab...

CVE-2023-20982

CVE-2023-20982 affects Android 13 and involves a missing bounds check in the Bluetooth stack (btm_read_tx_power_complete in btm_acl.cc), causing a possible out-of-bounds read that can disclose local information. Exploitation would require System-level privileges with no user interaction, and is d...

CVE-2024-25986

CVE-2024-25986 affects the drm_fw.c component’s ppmp_unprotect_buf logic, enabling possible protection-memory compromise and local escalation of privilege to TEE without extra execution privileges; user interaction is not required. No exploitation details or patch information are provided in the ...

CVE-2024-27207

CVE-2024-27207 affects Android/Google Pixel devices and is described as an elevation-of-privilege issue caused by exported broadcast receivers that can bypass broadcast protection. The Red Hat/NVD entries reiterate the export receivers vulnerability with the same description, and the Android Pixe...

CVE-2024-31334

CVE-2024-31334 affects the DevmemIntFreeDefBackingPage function in the Android/Linux kernel code path devicemem_server.c. The described logic error could allow arbitrary code execution leading to local elevation of privilege without requiring user interaction. Exploitation is local (no remote vec...

CVE-2024-34724

CVE-2024-34724 describes a race condition in the kernel function _UnrefAndMaybeDestroy (pmr.c) that can enable arbitrary code execution and local escalation of privilege without user interaction. The vulnerability is rooted in race timing within memory/reference handling, allowing a local attacke...

CVE-2024-34747

CVE-2024-34747 is described across multiple sources as a use‑after‑free in the DevmemXIntMapPages path of devicemem_server.c. The underlying flaw is a logic error that can enable local escalation of privilege in the kernel without additional execution privileges and without user interaction. The ...

CVE-2024-43087

Android vulnerability CVE-2024-43087 affects the accessibility subsystem: in AccessibilitySettings.java, getInstalledAccessibilityPreferences contains a logic flaw that can allow hiding an enabled accessibility service in the settings. This could enable local escalation of privilege with no extra...

CVE-2024-44095

CVE-2024-44095 affects Google Pixel/Android via the function ppmp_protect_mfcfw_buf in code/drm_fw.c, where a logic error can cause memory corruption and local privilege escalation without needing user interaction. The issue is classified as Elevation of Privilege (EoP) with high impact (confiden...

CVE-2025-0078

CVE-2025-0078 describes a logic error in the Android main.cpp main function that may bypass SELinux, enabling local elevation of privilege with no extra privileges or user interaction required. The vulnerability is categorized as EoP with a high impact, and current sources indicate the issue affe...

CVE-2025-48651

Summary: CVE-2025-48651 pertains to StrongBox in Android. In KMKeymasterApplet.java’s importWrappedKey, insufficient input validation could allow access to restricted keys, enabling local information disclosure without extra privileges or user interaction. The issue is classed as a local vulnerab...

CVE-2015-3104

CVE-2015-3104 is an integer overflow in Adobe Flash Player (Windows, macOS, Linux) and related Adobe AIR/SDK components. The flaw allows arbitrary code execution via unspecified vectors and affects Flash Player versions prior to 13.0.0.292, 14.x up to 18.x before 18.0.0.160 (Windows/macOS) and pr...

CVE-2020-0253

CVE-2020-0253 is a memory corruption (use-after-free) vulnerability in the MediaTek Multimedia Processing Driver for Android, classified as Elevation of Privilege (EoP) with High impact. Affected: Android devices using MediaTek multimedia driver; root cause: use-after-free leading to unauthorized...

CVE-2020-0254

CVE-2020-0254 is an information-disclosure vulnerability in Android’s MediaTek Multimedia Processing Driver. It stems from an incorrect bounds check, which could allow an out-of-bounds read. The issue is associated with the MediaTek component in Android and is documented in the Android 2020 secur...

CVE-2021-0635

CVE-2021-0635 affects the Video component (Unisoc/Android 10) where extracting an incorrectly formatted FLV file can corrupt memory, causing a crash and video playback failure. The Red Hat/NVD entries describe potential for malicious code execution leading to loss of user rights, with CVSS 3.1 ba...

CVE-2021-0883

The CVE-2021-0883 entry affects the PVRSRVBridgeCacheOpQueue in the PowerVR kernel driver. A missing size check can cause an integer overflow, enabling out-of-bounds heap access and local escalation of privilege without extra execution privileges. Impact is described as local EoP with high confid...

CVE-2021-0904

Summary: CVE-2021-0904 affects SRAMROM and describes a possible permission bypass due to an insecure permission setting, enabling local escalation of privilege with System execution privileges required. Exploitation is reported as requiring no user interaction. Affecting components: MediaTek/ALPS...

CVE-2022-20060

CVE-2022-20060: Affects MediaTek preloader (usb) across multiple MT chipsets (e.g., MT6761/6762/6765/6768/6771/6779/6781/6785/6833/6853/6873/6875/6877/6885/6889/6893/8183/8185/8321/8385/8666/8667/8675/8735a/8735b/8765/8766/8768/8786/8788/8789/8791/8797). Describes a missing proper image authentic...

CVE-2022-20101

CVE-2022-20101 describes a path traversal vulnerability in the aee daemon that can cause local information disclosure without requiring user interaction. The underlying issue is a path traversal flaw, enabling disclosure of sensitive data with local access. The exposure is supported by multiple s...

CVE-2022-20155

CVE-2022-20155 affects the Android kernel component ipu-core-jqs-msg-transport.c, specifically the function ipu_core_jqs_msg_transport_kernel_write_sync. The vulnerability arises from a race condition that can cause a use-after-free, enabling local escalation of privilege without additional execu...

CVE-2022-20190

Technical details for CVE-2022-20190 are not publicly available in the provided documents. No concrete information on affected components, root cause, impact, or fixes is present. Monitor for updates.

CVE-2022-20201

The CVE-2022-20201 issue affects Android's InstalldNativeService.cpp, specifically the getAppSize function, where a missing bounds check can cause an out-of-bounds read. This enables local escalation of privileges with System execution privileges implied, and exploitation does not require user in...

CVE-2022-20377

CVE-2022-20377 affects Android’s keymaster_ipc.cpp, enabling an attacker to force gatekeeper, fingerprint, and faceauth to use a known HMAC key. This configuration flaw can lead to local elevation of privilege with no additional execution privileges required and without user interaction. Public r...

CVE-2022-20378

CVE-2022-20378 affects Android kernel and Pixel modem. The Pixel security bulletin lists it under the Kernel/Modem category as an Elevation of Privilege (EoP) issue with “Modem” as the component and indicates a high-severity impact, corroborated by NVD’s CVSS v3.1 base score of 9.8 (CRITICAL) wit...

CVE-2022-20384

CVE-2022-20384 is referenced in Pixel security bulletin as an Elevation of Privilege in the Modem component affecting Google Pixel devices (Modem stack). The bulletin groups it under Pixel issues and indicates affected devices receive patches at the 2022-08-05 security level. No explicit root-cau...

CVE-2022-2984

CVE-2022-2984 affects the jpg driver in the Linux kernel. The root cause is a missing bounds check that can cause an out-of-bounds write, leading to local Denial of Service. The available connected documents consistently state a kernel-level impact but do not provide exploit details, affected ker...

CVE-2022-42770

CVE-2022-42770 describes a race condition in the WLAN driver that could cause a local denial of service. The vulnerability is referenced across multiple advisories (e.g., Red Hat CVE entry, NVD entry, and Unisoc/kernel listings) and is labeled with a MEDIUM severity (CVSSv3.1: 4.7; LOCAL access, ...

CVE-2022-47470

The CVE-2022-47470 issue concerns the ext4fsfilter driver and is caused by a missing bounds check that leads to an out-of-bounds read. The vulnerability allows local denial of service with SYSTEM privileges required, as described in multiple sources (e.g., Red Hat, NVD, CVE lists). Affected compo...

CVE-2022-48454

CVE-2022-48454 concerns the wifi service, where a missing bounds check can cause an out-of-bounds write leading to local denial of service without extra privileges. The issue is supported by multiple sources in the provided set (NVD entry reproduces the description and CVSS metrics; Red Hat advis...

CVE-2023-20621

CVE-2023-20621 affects tinysys and describes an out-of-bounds write caused by a missing bounds check, enabling local privilege escalation with System privileges and no user interaction required. Public details indicate a patch ID ALPS07664755 (Issue ALPS07664755) exists, but the exact vulnerable ...