CVE-2020-11836

Technical details about CVE-2020-11836 are not provided in the supplied documents; no specifics on affected components, root cause, or fixes are publicly available. Monitor for updates.

CVE-2021-0468

CVE-2021-0468 maps to an elevation of privilege in LK (Little Kernel) used on Android devices. The root cause is an insecure default value in LK, enabling local privilege escalation when an attacker has physical access and no additional execution privileges are required; exploitation may require ...

CVE-2021-0873

CVE-2021-0873 : A missing size check in PVRSRVBridgeRGXKickRS within the PowerVR kernel driver can cause an integer overflow, enabling out-of-bounds heap access. This may permit local escalation of privilege with no additional execution privileges required and without user interaction. The issue ...

CVE-2021-1004

CVE-2021-1004 affects Android 12, via a missing permission check in getConfiguredNetworks() of WifiServiceImpl.java that can allow an app to determine whether another app is installed without query permissions. This is a local privilege escalation (no user interaction required) per the descriptio...

CVE-2021-39653

CVE-2021-39653 describes a local elevation of privilege in the Android boot path, enabling boot with a hidden debug policy due to a missing user warning. The vulnerability is associated with the Android kernel/Bootloader surface (as reflected in Pixel bulletin categorization), and iled by the des...

CVE-2021-39781

CVE-2021-39781 affects Android 12L with a vulnerability in SmsController permitting information disclosure via a permissions bypass, enabling local escalation of privilege and SMS sending without extra privileges. The issue is documented in Android 12L security release notes; mitigation is provid...

CVE-2022-20040

The CVE-2022-20040 entry concerns a vulnerability in the MediaTek power_hal_manager_service (Power HAL) where a stack-based buffer overflow can permit local escalation of privilege without user interaction. Exploitation requires local access and the issue is described across multiple sources (e.g...

CVE-2022-20079

The CVE-2022-20079 entry concerns the vow component. Root cause: improper input validation enables a read of uninitialized data, causing local information disclosure with system execution privileges required; user interaction is not required. A patch is listed (ALPS05837742; ALPS05857289). Connec...

CVE-2022-20146

CVE-2022-20146 affects Android via the information disclosure in the uploadFile function of FileUploadServiceImpl.java, caused by a confused deputy that can expose private files locally without extra privileges. Exploitation is local and does not require user interaction. Public details in the co...

CVE-2022-20164

CVE-2022-20164 is listed in the Pixel security bulletin as an Elevation of Privilege (EoP) affecting the Modem component, tied to the Android kernel. The connected Pixel bulletin entry confirms the issue is categorized as EoP for Modem with no public exploit details provided in the documents. The...

CVE-2022-20173

Technical details about CVE-2022-20173 are not provided in the supplied documents. No specifics on affected components or impact. Monitor for updates.

CVE-2022-20176

CVE-2022-20176 affects the Android kernel, specifically the sjtag-driver.c module in the auth_store path. The root cause is a missing bounds check that allows a read of uninitialized memory. This can lead to a local information disclosure and, per the description, may enable system-level executio...

CVE-2022-20202

CVE-2022-20202 affects Android 12L via the function ih264_resi_trans_quant_4x4_sse42 (ih264_resi_trans_quant_sse42.c). It describes a heap buffer overflow that enables a possible out-of-bounds read, leading to remote information disclosure with no default execution privileges; exploitation requir...

CVE-2022-20207

CVE-2022-20207 affects Android 12L via the static definition in GattServiceConfig.java , where an insecure default value permits a permission bypass leading to local elevation of privilege without user interaction. The issue is described across multiple sources (Android/Red Hat/NVD entries) as a ...

CVE-2022-20403

CVE-2022-20403 targets Google Pixel devices via the Android modem component. The Pixel security bulletin classifies it as RCE (critical) in the Modem with a high impact; the NVD entry records a CVSSv3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The initial records list Product: And...

CVE-2022-20443

CVE-2022-20443 concerns Android 13 where the hasInputInfo function in Layer.cpp may bypass user interaction via a tapjacking/overlay attack, enabling local escalation of privilege with no extra execution privileges and no user interaction required for exploitation. Affected product: Android 13 (A...

CVE-2022-20514

CVE-2022-20514 affects Android 13 and is tied to the Idmap2Service.cpp code path. The issue is an out-of-bounds write caused by a use-after-free in acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator, which could enable local escalation of privilege ...

CVE-2022-20533

Android 13 contains a local privilege escalation risk in WifiSlice.java (getSlice). A missing permission check could allow an attacker with local access to connect to a new WiFi network from guest mode, with no user interaction required. Public documents confirm the issue but do not provide patch...

CVE-2022-20570

Technical details for CVE-2022-20570 are not publicly available in the provided documents. Monitor for updates from the listed sources; no specifics on affected versions, vectors, or fixes are provided here.

CVE-2022-21753

CVE-2022-21753 affects a WLAN driver where a missing bounds check can cause an out-of-bounds write, enabling local escalation to SYSTEM privileges with no user interaction. This is described across sources (NVD/Red Hat/CVE list) as a local-privilege-escalation issue in the WLAN driver, with the p...

CVE-2022-27834

CVE-2022-27834: Use-after-free in the DSP driver’s dsp_context_unload_graph function (pre-SMR Apr-2022 Release 1). Affects the DSP driver; attackers could cause malicious actions. Root cause: use-after-free in the affected function. CVSS details show high impact under CVSS 3.1 (LOCAL, HIGH impact...

CVE-2022-42516

CVE-2022-42516 affects Android kernel in ProtocolSimBuilderLegacy::BuildSimGetGbaAuth. The flaw is an out-of-bounds read caused by a missing bounds check, enabling local information disclosure with System privileges (no user interaction required). Exploitation and impact are described in multiple...

CVE-2022-42526

The CVE-2022-42526 entry concerns an out-of-bounds write in ConvertUtf8ToUcs2 within radio_hal_utils.cpp, tied to the Android kernel. The root cause is a missing bounds check in that function, which could allow a local escalation of privilege with System privileges required; exploitation is descr...

CVE-2022-42544

CVE-2022-42544 concerns a local-privilege-escalation issue in Android 13 stemming from getView() in AddAppNetworksFragment.java. The vulnerability arises from improper input validation that can mislead users about network add requests, with exploitation possible without extra privileges or user i...

CVE-2023-20997

CVE-2023-20997 concerns Android 13 where multiple locations allow triggering a persistent reboot loop due to improper input validation. This yields local denial of service with user execution privileges required, and no user interaction is needed for exploitation. The issue is documented as a DoS...

CVE-2023-21194

The CVE-2023-21194 entry concerns Android 13 Bluetooth stack (gatt_utils.cc: gatt_dbg_op_name). A missing bounds check allows an out-of-bounds read, enabling local information disclosure via the Bluetooth server. Exploitation requires System privileges; no user interaction is needed. Public detai...

CVE-2023-21358

CVE-2023-21358 affects Google Android UWB: a malicious app can masquerade as the system app com.android.uwb.resources due to improper crypto usage, enabling local elevation of privilege with no extra execution privileges and no user interaction required. CVSSv3.1 base score 7.8 (HIGH) with LOCAL ...

CVE-2023-35686

The CVE-2023-35686 vulnerability affects PVRSRVRGXKickTA3DKM in rgxta3d.c, where improper input validation allows arbitrary code execution and local privilege escalation in the kernel. Exploitation is described as local with no additional privileges and no user interaction required. Multiple conn...

CVE-2023-48341

CVE-2023-48341 affects the video decoder. The issue is an out-of-bounds read caused by improper input validation, which could lead to a local denial of service without requiring additional privileges. The provided documents do not specify a fix or remediation details, and exploitation status is n...

CVE-2023-48401

CVE-2023-48401 affects the protocoladapter.cpp function GetSizeOfEenlRecords, causing an out-of-bounds read and potential local information disclosure with no user interaction. The available documents consistently describe the root cause as a bounds-check error and do not provide explicit exploit...

CVE-2023-52342

A security vulnerability exists in UNISOC Chipsets (Purple Spreadtrum) within the modem-ps-nas-ngmm module. The flaw stems from incorrect error handling , which can lead to undefined behavior . This vulnerability may allow for remote information disclosure without requiring additional execution p...

CVE-2024-23658

A use after free vulnerability exists in the camera driver of UNISOC Chipsets due to a logic error that results in memory reuse after release. This flaw could lead to a local denial of service (DoS), though it requires System execution privileges . While the vulnerability affects Android versions...

CVE-2024-32892

CVE-2024-32892 involves a memory corruption vulnerability in the Goodix driver path, specifically in handle_init of goodix/main/main.c, caused by type confusion. The issue can enable local privilege escalation without user interaction. Public details in the connected sources confirm the affected ...

CVE-2024-32907

The CVE-2024-32907 entry describes a buffer overflow in memcall_add within memlog.c caused by improper input validation, enabling local privilege escalation without user interaction. Connected sources (Red Hat, NVD, OSV, and Android bulletin references) consistently report the same description bu...

CVE-2024-32910

The CVE-2024-32910 issue affects Trusty/TEE in the Android stack (tipc.c: handle_msg_shm_map_req). It describes a possible stack data disclosure from uninitialized data in the SPI/TIPC path, enabling local information disclosure without extra privileges or user interaction. The Android Pixel bull...

CVE-2024-47038

CVE-2024-47038 describes an out-of-bounds write in the function dhd_prot_flowrings_pool_release within dhd_msgbuf.c, caused by a missing bounds check. This can lead to local privilege escalation with no user interaction required. Documents collectively indicate a Linux/Android kernel context (Pix...

CVE-2025-0084

Google Android is impacted by a code execution vulnerability involving an out-of-bounds write caused by a use-after-free condition in multiple locations. If Hands-Free Profile (HFP) support is enabled, an attacker can achieve remote code execution over Bluetooth without requiring additional privi...

CVE-2017-0412

CVE-2017-0412 is an elevation-of-privilege vulnerability in Android Framework APIs that could let a local malicious app execute code with a privileged process. Affected: Android 7.0 and 7.1.1. Root cause involves Framework APIs enabling privilege escalation; Android patch levels 2017-02-01 / 2017...

CVE-2018-9339

CVE-2018-9339 affects Android’s framework Parcel.java, specifically in the methods writeTypedArrayList/readTypedArrayList, with a root cause of type confusion that enables local privilege escalation. The vulnerability can be exploited with no user interaction and requires local access. Public doc...

CVE-2018-9352

CVE-2018-9352 affects the ihevcd_allocate_dynamic_bufs function in ihevcd_api.c. The vulnerability is a resource exhaustion due to an integer overflow, potentially enabling remote denial of service with no code execution required. Exploitation requires user interaction. Connected sources (Red Hat...

CVE-2020-0054

CVE-2020-0054 affects Android 10 in the WifiNetworkSuggestionsManager component. The vulnerability arises from a missing permission check in WifiNetworkSuggestionsManager.java, enabling local privilege escalation without additional execution privileges. Public details specify that exploitation re...

CVE-2020-0430

CVE-2020-0430 affects the Linux kernel skb_headlen in /include/linux/skbuff.h, causing a possible out-of-bounds read due to memory corruption and enabling local privilege escalation without user interaction. Affected product context in provided docs is Android kernel/Unity Linux kernel. Exploitat...

CVE-2021-0583

CVE-2021-0583 affects Android (9/10) and relates to the BluetoothPairingDialog onCreate, enabling a tapjacking/overlay scenario that could lead to local elevation of privilege. According to Red Hat and NVD entries, exploitation requires user interaction (UI: Required) and local access, with a hig...

CVE-2021-0606

CVE-2021-0606 concerns the Android kernel DRM driver, specifically the function drm_syncobj_handle_to_fd in drm_syncobj.c. The issue is a use-after-free caused by incorrect refcounting, which can allow local escalation of privilege with system execution privileges required. User interaction is no...

CVE-2021-1010

CVE-2021-1010: In Android 12, the Android framework component PackageManagerService.getSigningKeySet is missing a permission check, enabling local information disclosure without elevation or user interaction. The CVSS 3.1 base score is 5.5 (MEDIUM), with local attack vector and HIGH confidentiali...

CVE-2021-39773

CVE-2021-39773 affects Android 12L where VpnManagerService may disclose installed VPN packages via a side-channel information disclosure, enabling local information disclosure without extra execution privileges. The issue is described in Android 12L security release notes and related CVE listings...

CVE-2022-20017

CVE-2022-20017 affects the ion driver and is described as an information-disclosure vulnerability caused by an incorrect bounds check, enabling local information disclosure without extra execution privileges and with no user interaction required. Documented impact per NVD/CVE listings: CVSSv3.1 b...

CVE-2022-20046

The CVE-2022-20046 entry describes a Bluetooth memory corruption due to a logic error that could cause local denial of service without user interaction. The vulnerability is associated with a patch identified as ALPS06142410 (Issue ALPS06142410). Public exploitation details, affected product name...

CVE-2022-20056

CVE-2022-20056 affects the preloader (usb) on MediaTek-based devices, with an out-of-bounds write due to a missing bounds check. The issue can lead to local privilege escalation when an attacker has physical access, with user interaction required for exploitation. Impact is described as partial c...

CVE-2022-20067

CVE-2022-20067 affects mdp with an out-of-bounds write caused by a missing bounds check, enabling local escalation to SYSTEM privileges without user interaction. Exploitation details are not provided in the documents, but multiple sources confirm the issue and reference patch ALPS05836585 (Issue ...