CVE-2023-21016

CVE-2023-21016 affects Android 13 via AccountTypePreference.java, where improper input validation can mislead users about installed accounts, enabling local denial of service with no extra privileges and no user interaction required. The issue is described across multiple feeds (NVD, Red Hat, PRi...

CVE-2023-21047

CVE-2023-21047 affects Android kernel, with the issue localized to ConvertToHalMetadata in aidl_utils.cc where a missing bounds check enables an out-of-bounds read. This can lead to local information disclosure with system-level privileges required for exploitation and does not require user inter...

CVE-2023-21069

Summary: CVE-2023-21069 affects the Android kernel (bcm4389 driver) in the wl_update_hidden_ap_ie function of wl_cfgscan.c, causing an out-of-bounds write due to a missing bounds check. This enables local escalation of privilege (System level) without user interaction. Technical details confirmed...

CVE-2023-21228

CVE-2023-21228 describes an out-of-bounds write in the Linux kernel component physmem_osmem_linux.c (PMRChangeSparseMemOSMem), caused by an incorrect bounds check. This could enable local escalation of privilege with no user interaction. Public documents confirm the vulnerability details and affe...

CVE-2023-21358

CVE-2023-21358 affects Google Android UWB: a malicious app can masquerade as the system app com.android.uwb.resources due to improper crypto usage, enabling local elevation of privilege with no extra execution privileges and no user interaction required. CVSSv3.1 base score 7.8 (HIGH) with LOCAL ...

CVE-2023-32877

CVE-2023-32877 affects MediaTek battery module with a missing bounds check causing an out-of-bounds write. This can enable local escalation of privilege with System execution privileges required; exploitation does not require user interaction. The provided documents consistently reference the iss...

CVE-2023-35646

CVE-2023-35646 is documented in multiple sources as a stack buffer overflow in TBD components with missing bounds checks, enabling remote code execution without user interaction. In the Pixel security bulletin, this issue is mapped to the Shannon baseband on Google Pixel devices, classified as RC...

CVE-2023-48406

CVE-2023-48406 affects Google Pixel devices, specifically the Modem OTP component used in Pixel firmware. The public descriptions describe a logic error that can cause a permanent DoS or allow the modem to boot with unverified firmware. This could lead to local escalation of privilege, requiring ...

CVE-2023-48420

The CVE-2023-48420 entry describes a race-condition–driven use-after-free in the Camera component on Pixel devices, enabling local escalation of privilege with System-level privileges and no user interaction. The vulnerability is categorized as EoP (Camera) in the Pixel security bulletin, with a ...

CVE-2024-20001

The CVE-2024-20001 issue affects TVAPI and is caused by a missing bounds check leading to an out-of-bounds write, enabling local escalation of privilege with System privileges required; no user interaction is needed. Multiple connected sources (NVD, Red Hat, CVE lists) confirm the same descriptio...

CVE-2024-20081

CVE-2024-20081 affects the gnss service. The issue is an out-of-bounds write caused by improper input validation, leading to local escalation of privilege with system execution privileges required. Exploitation is reported to require no user interaction. A fix is available as patch ID ALPS0871960...

CVE-2024-29750

CVE-2024-29750 : The issue is a possible out-of-bounds read in the km_exp_did_inner function of kmv.c due to a missing bounds check. This can lead to local information disclosure without extra execution privileges and without user interaction. Public details on affected versions or a fix are not ...

CVE-2024-32902

CVE-2024-32902 affects Google Pixel devices, tied to the modem component, and is described as a DoS leading to remote denial of cellular service via malformed packets. The issue is categorized as high severity with network attack vector and low complexity. Pixel security bulletin indicates a patc...

CVE-2024-47038

CVE-2024-47038 describes an out-of-bounds write in the function dhd_prot_flowrings_pool_release within dhd_msgbuf.c, caused by a missing bounds check. This can lead to local privilege escalation with no user interaction required. Documents collectively indicate a Linux/Android kernel context (Pix...

CVE-2024-53836

CVE-2024-53836 is an out-of-bounds write vulnerability in the Android wb_regon_coordinator.c file, specifically in the function wbrc_bt_dev_write. The issue arises from a lack of bounds checking, allowing a potential buffer overflow that could enable local escalation of privilege with System exec...

CVE-2025-48552

CVE-2025-48552 affects DevicePolicyManagerService.java, specifically the saveGlobalProxyLocked function. A logic error can cause desync from persistence, enabling local privilege escalation without extra execution privileges or user interaction. The vulnerability is described consistently across ...

CVE-2015-3098

Adobe Flash Player and related AIR components are affected by a vulnerability (CVE-2015-3098) that could bypass the Same Origin Policy via unspecified vectors. Mageia MGASA-2015-0248 notes a fix in Flash Player 11.2.202.468 and links CVE-2015-3098 to this update. Affected versions include Windows...

CVE-2017-7759

Firefox for Android prior to version 54 is affected by CVE-2017-7759, where Android intent URLs can cause navigation from HTTP/HTTPS to local file: URLs, potentially exposing local data due to a same-origin policy violation. The issue is fixed in Firefox 54 (as noted in mfsa2017-15). Affected pro...

CVE-2020-0050

CVE-2020-0050 is an Android System issue affecting Android 10 where in nfa_hciu_send_msg (nfa_hci_utils.cc) an out-of-bounds write can occur due to improper input validation. This could enable local elevation of privilege in the NFC server with system-level execution privileges; exploitation does...

CVE-2020-13842

Technical details (affected product/versions/root cause/patch) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2021-1004

CVE-2021-1004 affects Android 12, via a missing permission check in getConfiguredNetworks() of WifiServiceImpl.java that can allow an app to determine whether another app is installed without query permissions. This is a local privilege escalation (no user interaction required) per the descriptio...

CVE-2021-39757

CVE-2021-39757 affects Android 12L with a permission bypass in the PermissionController caused by unsafe PendingIntent, enabling local information disclosure. Exploitation requires low privileges and no user interaction, with potential access to sensitive data on the device as described in multip...

CVE-2021-39769

CVE-2021-39769 concerns an information-disclosure vulnerability in Android 12L’s Device Policy component where there is a missing permission check that allows an app to determine whether another app is installed without query permissions. The issue enables local information disclosure without ext...

CVE-2021-39787

CVE-2021-39787 affects Android 12L SystemUI. The issue enables an arbitrary Activity launch via a confused deputy, resulting in local elevation of privilege with no extra execution privileges required and a required user interaction for exploitation. Affected component: SystemUI on Android-12L; r...

CVE-2022-20049

CVE-2022-20049 affects the vpu component and describes a missing permission check that can enable local privilege escalation with System execution privileges required. Exploitation does not require user interaction. A patch is referenced (ALPS05954679; ALPS05954679). Connected sources confirm thi...

CVE-2022-20058

In MT MediaTek devices, CVE-2022-20058 is a boundary-check flaw in the preloader (USB) that can cause an out-of-bounds write. The issue enables local escalation of privilege when an attacker has physical access to the device, with user interaction required for exploitation. Affected products are ...

CVE-2022-20069

CVE-2022-20069 affects the preloader (usb) and involves an out-of-bounds write caused by an integer overflow. The documented impact is local privilege escalation for an attacker with physical access to the device, with user interaction required for exploitation. Affected details specify a patch i...

CVE-2022-20072

CVE-2022-20072 affects MediaTek devices via a flaw in the search engine service that allows changing the default search engine due to an incorrect comparison, enabling local privilege escalation to System. Exploitation status is not detailed in the provided documents; user interaction is not requ...

CVE-2022-20074

CVE-2022-20074 concerns a boundary-check omission in the preloader (partition) of MediaTek devices, causing an out-of-bounds write that can enable local privilege escalation with physical access and user interaction required for exploitation. Affected component: preloader partition code on MediaT...

CVE-2022-20079

The CVE-2022-20079 entry concerns the vow component. Root cause: improper input validation enables a read of uninitialized data, causing local information disclosure with system execution privileges required; user interaction is not required. A patch is listed (ALPS05837742; ALPS05857289). Connec...

CVE-2022-20091

CVE-2022-20091 describes a use-after-free due to a race condition in the MediaTek aee driver, enabling local escalation of privilege to SYSTEM with no user interaction required. The issue is documented with patch ALPS06209201 and issue ALPS06226345. Connected sources confirm this is a real, drive...

CVE-2022-20160

CVE-2022-20160 is documented as a critical remote code execution (RCE) vulnerability in Google Pixel devices, specifically affecting the Modem component. Public records classify it as a Modem-related issue (RCE, Critical) in the Pixel bulletin, with the Android patch level 2022-06-05 or later add...

CVE-2022-20165

CVE-2022-20165 affects the Android kernel component asn1_parse in asn1.c, where an incorrect bounds check can cause an out-of-bounds read. The consequence is local information disclosure with system execution privileges potentially required. The CVE is described as requiring no user interaction a...

CVE-2022-20182

CVE-2022-20182 concerns the Android kernel component handle_ramdump inside pixel_loader.c. The vulnerability arises from a missing permission check, enabling creation of a ramdump of non-secure memory and potentially leading to local information disclosure with SYSTEM privileges required. Exploit...

CVE-2022-20206

CVE-2022-20206 affects Android 12L via NotificationManagerService.setPackageOrComponentEnabled, where a missing permission check enables local information disclosure about enabled notification listeners. The issue requires User privileges but not user interaction to exploit, yielding a HIGH confi...

CVE-2022-20373

CVE-2022-20373 affects the Android kernel, specifically the st21nfc_loc_set_polaritymode function in fc/st21nfc.c. The issue is a use-after-free caused by a race condition, enabling local elevation of privilege with SYSTEM privileges required and no user interaction needed. Connected sources (Red...

CVE-2022-20380

According to the Pixel security bulletin, CVE-2022-20380 is listed under the Pixel component Modem with type ID (information disclosure) and High severity. The entry is tied to Android devices via a modem-related information-disclosure issue, not clearly specifying kernel-level impact in this bul...

CVE-2022-20511

CVE-2022-20511 affects Android 13 where a missing permission check in DevicePolicyManagerService.getNearbyAppStreamingPolicy could enable local information disclosure without additional privileges. The issue: local access suffices (no user interaction required) and the vulnerability is tied to in...

CVE-2022-20545

CVE-2022-20545 affects Android 13 on Google Pixel devices. The issue resides in the MediaControlPanel.java function bindArtworkAndColors, where improper input validation can crash the phone, causing a remote denial of service with no additional execution privileges required. Exploitation does not...

CVE-2022-20547

The CVE-2022-20547 entry concerns Android 13 where multiple functions in AdapterService.java can manipulate Bluetooth state due to a missing permission check, enabling local privilege escalation with no extra execution privileges and no user interaction required. The available sources (NVD/Red Ha...

CVE-2022-20578

CVE-2022-20578 : Vulnerability in RadioImpl::setGsmBroadcastConfig of ril_service_legacy.cpp can cause a stack clash and memory corruption, enabling local privilege escalation with System privileges required. The issue is exploitable locally (no user interaction) and affects Android kernels using...

CVE-2022-21747

CVE-2022-21747 affects the imgsensor component in MediaTek-based devices. A missing bounds check enables out-of-bounds reads, which could cause local denial of service with system privileges required. The vulnerability does not require user interaction for exploitation. A patch is referenced as A...

CVE-2022-22270

CVE-2022-22270 is an implicit Intent hijacking vulnerability in Samsung Dialer prior to SMR Jan-2022 Release 1 that allows unprivileged apps to access contact information. Affected: Samsung Dialer on Samsung Android devices; root cause is improper handling of implicit intents in the Dialer. Impac...

CVE-2022-24929

Summary: CVE-2022-24929 affects Samsung AppLock (Android) prior to SMR Mar-2022 Release 1, where an unprotected Activity allows an attacker to change the list of locked apps without authentication. Affected component: AppLock on Samsung Android devices (unprotected activity in AppLock). Root caus...

CVE-2022-25818

CVE-2022-25818 affects the Samsung UWB stack (prior to SMR Mar-2022 Release 1). The issue is an improper boundary check in the UWB implementation that enables arbitrary code execution. Public details across connected records confirm the vulnerability exists in Samsung/UWB, with mitigation via Sam...

CVE-2022-30726

CVE-2022-30726 corresponds to an unprotected DeviceSearchTrampoline component in Samsung SecSettingsIntelligence, enabling local attackers to launch SecSettingsIntelligence activities. Affected: Samsung Mobile/SecSettingsIntelligence (DeviceSearchTrampoline). Root cause: unprotected component exp...

CVE-2022-42518

CVE-2022-42518 affects the Android kernel (rild_exynos) via an out-of-bounds write in BroadcastSmsConfigsRequestData::encode (smsdata.cpp) caused by a missing bounds check. This can enable local escalation of privilege with System execution privileges; no user interaction is required. Public deta...

CVE-2023-20989

CVE-2023-20989 is a vulnerability in the Android Bluetooth stack. In the function btm_ble_write_adv_enable_complete within btm_ble_gap.cc , there is an out-of-bounds read due to a missing bounds check. This can lead to local information disclosure and may require System privileges for exploitatio...

CVE-2023-21019

CVE-2023-21019 affects Android 13 components, specifically a heap buffer overflow in ih264e_init_proc_ctxt within ih264e_process.c that can cause an out-of-bounds read and local information disclosure without requiring user interaction or elevated privileges. The vulnerability is documented with ...

CVE-2023-21034

CVE-2023-21034 affects Android 13 devices, with the vulnerability located in multiple SensorService.cpp functions where a permissions bypass may allow access to accurate sensor data, causing local privilege escalation. The issue is described as needing low privileges and no user interaction, with...