CVE-2022-42504

CVE-2022-42504 affects the Android kernel component CallDialReqData::encodeCallNumber (callreqdata.cpp). It describes an out-of-bounds write caused by an incorrect bounds check, enabling local escalation of privilege with System execution privileges required. Exploitation is not dependent on user...

CVE-2022-42512

CVE-2022-42512 affects the Android kernel component in VsimOperationDataExt::encode (vsimdata.cpp). The issue is an out-of-bounds read caused by a missing bounds check, enabling local information disclosure with System privileges; no user interaction needed. Connected sources confirm the vulnerab...

CVE-2022-42516

CVE-2022-42516 affects Android kernel in ProtocolSimBuilderLegacy::BuildSimGetGbaAuth. The flaw is an out-of-bounds read caused by a missing bounds check, enabling local information disclosure with System privileges (no user interaction required). Exploitation and impact are described in multiple...

CVE-2022-42521

CVE-2022-42521 affects the Android kernel component wlandata.cpp where the encode path can trigger an out-of-bounds write due to improper input validation. The exploitation requires local access (LOCAL) with high privileges (PR:H) and no user interaction. Impact is defined as full compromise of c...

CVE-2022-42525

CVE-2022-42525 affects Android’s ril_service_1_6.cpp in the Android kernel stack, where an incorrect bounds check can cause an out-of-bounds write. The documented impact is local escalation of privilege with System execution privileges required, and exploitation is listed as requiring no user int...

CVE-2023-20997

CVE-2023-20997 concerns Android 13 where multiple locations allow triggering a persistent reboot loop due to improper input validation. This yields local denial of service with user execution privileges required, and no user interaction is needed for exploitation. The issue is documented as a DoS...

CVE-2023-21016

CVE-2023-21016 affects Android 13 via AccountTypePreference.java, where improper input validation can mislead users about installed accounts, enabling local denial of service with no extra privileges and no user interaction required. The issue is described across multiple feeds (NVD, Red Hat, PRi...

CVE-2023-21047

CVE-2023-21047 affects Android kernel, with the issue localized to ConvertToHalMetadata in aidl_utils.cc where a missing bounds check enables an out-of-bounds read. This can lead to local information disclosure with system-level privileges required for exploitation and does not require user inter...

CVE-2023-21060

CVE-2023-21060 affects the Android kernel, specifically in sms_GetTpPiIe within sms_PduCodec.c. The issue is an out-of-bounds read caused by a missing bounds check, enabling potential remote information disclosure with no extra execution privileges and no user interaction. Documented impact is in...

CVE-2023-21069

Summary: CVE-2023-21069 affects the Android kernel (bcm4389 driver) in the wl_update_hidden_ap_ie function of wl_cfgscan.c, causing an out-of-bounds write due to a missing bounds check. This enables local escalation of privilege (System level) without user interaction. Technical details confirmed...

CVE-2023-21228

CVE-2023-21228 describes an out-of-bounds write in the Linux kernel component physmem_osmem_linux.c (PMRChangeSparseMemOSMem), caused by an incorrect bounds check. This could enable local escalation of privilege with no user interaction. Public documents confirm the vulnerability details and affe...

CVE-2023-21358

CVE-2023-21358 affects Google Android UWB: a malicious app can masquerade as the system app com.android.uwb.resources due to improper crypto usage, enabling local elevation of privilege with no extra execution privileges and no user interaction required. CVSSv3.1 base score 7.8 (HIGH) with LOCAL ...

CVE-2023-32877

CVE-2023-32877 affects MediaTek battery module with a missing bounds check causing an out-of-bounds write. This can enable local escalation of privilege with System execution privileges required; exploitation does not require user interaction. The provided documents consistently reference the iss...

CVE-2023-35646

CVE-2023-35646 is documented in multiple sources as a stack buffer overflow in TBD components with missing bounds checks, enabling remote code execution without user interaction. In the Pixel security bulletin, this issue is mapped to the Shannon baseband on Google Pixel devices, classified as RC...

CVE-2023-48420

The CVE-2023-48420 entry describes a race-condition–driven use-after-free in the Camera component on Pixel devices, enabling local escalation of privilege with System-level privileges and no user interaction. The vulnerability is categorized as EoP (Camera) in the Pixel security bulletin, with a ...

CVE-2024-20001

The CVE-2024-20001 issue affects TVAPI and is caused by a missing bounds check leading to an out-of-bounds write, enabling local escalation of privilege with System privileges required; no user interaction is needed. Multiple connected sources (NVD, Red Hat, CVE lists) confirm the same descriptio...

CVE-2024-20081

CVE-2024-20081 affects the gnss service. The issue is an out-of-bounds write caused by improper input validation, leading to local escalation of privilege with system execution privileges required. Exploitation is reported to require no user interaction. A fix is available as patch ID ALPS0871960...

CVE-2024-29750

CVE-2024-29750 : The issue is a possible out-of-bounds read in the km_exp_did_inner function of kmv.c due to a missing bounds check. This can lead to local information disclosure without extra execution privileges and without user interaction. Public details on affected versions or a fix are not ...

CVE-2024-32902

CVE-2024-32902 affects Google Pixel devices, tied to the modem component, and is described as a DoS leading to remote denial of cellular service via malformed packets. The issue is categorized as high severity with network attack vector and low complexity. Pixel security bulletin indicates a patc...

CVE-2024-32904

CVE-2024-32904 concerns the ProtocolVsimOperationAdapter() function in protocolvsimadapter.cpp, where a missing bounds check can cause an out-of-bounds read. This may lead to local information disclosure with the requirement of baseband firmware compromise for exploitation, and no user interactio...

CVE-2024-47038

CVE-2024-47038 describes an out-of-bounds write in the function dhd_prot_flowrings_pool_release within dhd_msgbuf.c, caused by a missing bounds check. This can lead to local privilege escalation with no user interaction required. Documents collectively indicate a Linux/Android kernel context (Pix...

CVE-2024-53836

CVE-2024-53836 is an out-of-bounds write vulnerability in the Android wb_regon_coordinator.c file, specifically in the function wbrc_bt_dev_write. The issue arises from a lack of bounds checking, allowing a potential buffer overflow that could enable local escalation of privilege with System exec...

CVE-2025-20662

CVE-2025-20662 concerns PlayReady TA, where a missing bounds check enables a potential out-of-bounds read that could cause local escalation of privilege if the attacker already has System privileges. Exploitation reportedly does not require user interaction. The CVSS 3.1 vector (LOCAL, HIGH privi...

CVE-2025-48552

CVE-2025-48552 affects DevicePolicyManagerService.java, specifically the saveGlobalProxyLocked function. A logic error can cause desync from persistence, enabling local privilege escalation without extra execution privileges or user interaction. The vulnerability is described consistently across ...

CVE-2015-3098

Adobe Flash Player and related AIR components are affected by a vulnerability (CVE-2015-3098) that could bypass the Same Origin Policy via unspecified vectors. Mageia MGASA-2015-0248 notes a fix in Flash Player 11.2.202.468 and links CVE-2015-3098 to this update. Affected versions include Windows...

CVE-2017-7759

Firefox for Android prior to version 54 is affected by CVE-2017-7759, where Android intent URLs can cause navigation from HTTP/HTTPS to local file: URLs, potentially exposing local data due to a same-origin policy violation. The issue is fixed in Firefox 54 (as noted in mfsa2017-15). Affected pro...

CVE-2020-0050

CVE-2020-0050 is an Android System issue affecting Android 10 where in nfa_hciu_send_msg (nfa_hci_utils.cc) an out-of-bounds write can occur due to improper input validation. This could enable local elevation of privilege in the NFC server with system-level execution privileges; exploitation does...

CVE-2020-0371

CVE-2020-0371 is an Android vulnerability described as an out-of-bounds read due to a missing bounds check, affecting Android components on the Android SoC with Android ID A-163008256. The public records list this CVE across multiple sources (NVD, Red Hat, PRION, CVE List, OSV) with consistent wo...

CVE-2020-13842

Technical details (affected product/versions/root cause/patch) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2021-1004

CVE-2021-1004 affects Android 12, via a missing permission check in getConfiguredNetworks() of WifiServiceImpl.java that can allow an app to determine whether another app is installed without query permissions. This is a local privilege escalation (no user interaction required) per the descriptio...

CVE-2021-39757

CVE-2021-39757 affects Android 12L with a permission bypass in the PermissionController caused by unsafe PendingIntent, enabling local information disclosure. Exploitation requires low privileges and no user interaction, with potential access to sensitive data on the device as described in multip...

CVE-2021-39769

CVE-2021-39769 concerns an information-disclosure vulnerability in Android 12L’s Device Policy component where there is a missing permission check that allows an app to determine whether another app is installed without query permissions. The issue enables local information disclosure without ext...

CVE-2021-39787

CVE-2021-39787 affects Android 12L SystemUI. The issue enables an arbitrary Activity launch via a confused deputy, resulting in local elevation of privilege with no extra execution privileges required and a required user interaction for exploitation. Affected component: SystemUI on Android-12L; r...

CVE-2022-20049

CVE-2022-20049 affects the vpu component and describes a missing permission check that can enable local privilege escalation with System execution privileges required. Exploitation does not require user interaction. A patch is referenced (ALPS05954679; ALPS05954679). Connected sources confirm thi...

CVE-2022-20058

In MT MediaTek devices, CVE-2022-20058 is a boundary-check flaw in the preloader (USB) that can cause an out-of-bounds write. The issue enables local escalation of privilege when an attacker has physical access to the device, with user interaction required for exploitation. Affected products are ...

CVE-2022-20069

CVE-2022-20069 affects the preloader (usb) and involves an out-of-bounds write caused by an integer overflow. The documented impact is local privilege escalation for an attacker with physical access to the device, with user interaction required for exploitation. Affected details specify a patch i...

CVE-2022-20072

CVE-2022-20072 affects MediaTek devices via a flaw in the search engine service that allows changing the default search engine due to an incorrect comparison, enabling local privilege escalation to System. Exploitation status is not detailed in the provided documents; user interaction is not requ...

CVE-2022-20074

CVE-2022-20074 concerns a boundary-check omission in the preloader (partition) of MediaTek devices, causing an out-of-bounds write that can enable local privilege escalation with physical access and user interaction required for exploitation. Affected component: preloader partition code on MediaT...

CVE-2022-20160

CVE-2022-20160 is documented as a critical remote code execution (RCE) vulnerability in Google Pixel devices, specifically affecting the Modem component. Public records classify it as a Modem-related issue (RCE, Critical) in the Pixel bulletin, with the Android patch level 2022-06-05 or later add...

CVE-2022-20165

CVE-2022-20165 affects the Android kernel component asn1_parse in asn1.c, where an incorrect bounds check can cause an out-of-bounds read. The consequence is local information disclosure with system execution privileges potentially required. The CVE is described as requiring no user interaction a...

CVE-2022-20182

CVE-2022-20182 concerns the Android kernel component handle_ramdump inside pixel_loader.c. The vulnerability arises from a missing permission check, enabling creation of a ramdump of non-secure memory and potentially leading to local information disclosure with SYSTEM privileges required. Exploit...

CVE-2022-20206

CVE-2022-20206 affects Android 12L via NotificationManagerService.setPackageOrComponentEnabled, where a missing permission check enables local information disclosure about enabled notification listeners. The issue requires User privileges but not user interaction to exploit, yielding a HIGH confi...

CVE-2022-20231

CVE-2022-20231 affects the Android kernel on at least some Pixel/Android devices. The issue is an out-of-bounds write in smc_intc_request_fiq within arm_gic.c, caused by improper input validation, enabling local escalation of privilege with System execution privileges required; no user interactio...

CVE-2022-20380

According to the Pixel security bulletin, CVE-2022-20380 is listed under the Pixel component Modem with type ID (information disclosure) and High severity. The entry is tied to Android devices via a modem-related information-disclosure issue, not clearly specifying kernel-level impact in this bul...

CVE-2022-20511

CVE-2022-20511 affects Android 13 where a missing permission check in DevicePolicyManagerService.getNearbyAppStreamingPolicy could enable local information disclosure without additional privileges. The issue: local access suffices (no user interaction required) and the vulnerability is tied to in...

CVE-2022-20545

CVE-2022-20545 affects Android 13 on Google Pixel devices. The issue resides in the MediaControlPanel.java function bindArtworkAndColors, where improper input validation can crash the phone, causing a remote denial of service with no additional execution privileges required. Exploitation does not...

CVE-2022-20547

The CVE-2022-20547 entry concerns Android 13 where multiple functions in AdapterService.java can manipulate Bluetooth state due to a missing permission check, enabling local privilege escalation with no extra execution privileges and no user interaction required. The available sources (NVD/Red Ha...

CVE-2022-20578

CVE-2022-20578 : Vulnerability in RadioImpl::setGsmBroadcastConfig of ril_service_legacy.cpp can cause a stack clash and memory corruption, enabling local privilege escalation with System privileges required. The issue is exploitable locally (no user interaction) and affects Android kernels using...

CVE-2022-21747

CVE-2022-21747 affects the imgsensor component in MediaTek-based devices. A missing bounds check enables out-of-bounds reads, which could cause local denial of service with system privileges required. The vulnerability does not require user interaction for exploitation. A patch is referenced as A...

CVE-2022-22270

CVE-2022-22270 is an implicit Intent hijacking vulnerability in Samsung Dialer prior to SMR Jan-2022 Release 1 that allows unprivileged apps to access contact information. Affected: Samsung Dialer on Samsung Android devices; root cause is improper handling of implicit intents in the Dialer. Impac...