CVE-2018-9497

CVE-2018-9497 affects Android’s media framework. Affected component: the IMPEG-2 decoder, specifically in impeg2_fmt_conv_yuv420p_to_yuv420sp_uv_av8 within impeg2_format_conv.s, where a missing bounds check can cause an out-of-bounds write. This could lead to remote code execution with no additio...

CVE-2019-2021

CVE-2019-2021 describes an information-disclosure flaw in the Android rw_t3t.cc component: in rw_t3t_act_handle_ndef_detect_rsp there is a missing bounds check that allows an out-of-bounds read. This could enable local information disclosure with no execution privileges required, and exploitation...

CVE-2020-0283

CVE-2020-0283 describes a potential out-of-bounds write caused by a missing bounds check in affected Android components. Public vulnerability entries in NVD/NVD-derived feeds reiterate the issue with the Android platform. An OSV entry (ASB-A-163008257) also notes a possible out-of-bounds write du...

CVE-2020-13842

Technical details (affected product/versions/root cause/patch) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2021-0524

CVE-2021-0524 affects Android 12, related to CarPackageManagerService.java isServiceDistractionOptimized. The issue is a side-channel information disclosure that could allow a local disclosure of installed packages without additional execution privileges. Impact is local information disclosure wi...

CVE-2021-0557

CVE-2021-0557 affects Android 11 in the Media Framework component, specifically a vulnerability in the function setRange() of ABuffer.cpp. An integer overflow can cause an out-of-bounds write, which could enable remote code execution with no extra privileges, requiring user interaction to exploit...

CVE-2021-0681

CVE-2021-0681 is a vulnerability in Android where a missing permission check in system properties could allow local information disclosure without extra execution privileges and without user interaction. Affected components include MediaTek system properties on Android devices. The issue is docum...

CVE-2021-39740

CVE-2021-39740 affects the Android 12L messaging path. The issue arises from improper input validation in messaging, allowing an attacker to bypass attachment restrictions and cause local information disclosure without requiring user interaction or privileges. The vulnerability is categorized und...

CVE-2021-39747

CVE-2021-39747 affects Android 12L: a permissions bypass in Settings Provider may allow an attacker to list values of non-readable global settings, causing local information disclosure with no extra privileges and no user interaction. It is listed in Android 12L security release notes as addresse...

CVE-2022-20091

CVE-2022-20091 describes a use-after-free due to a race condition in the MediaTek aee driver, enabling local escalation of privilege to SYSTEM with no user interaction required. The issue is documented with patch ALPS06209201 and issue ALPS06226345. Connected sources confirm this is a real, drive...

CVE-2022-20104

CVE-2022-20104 affects the aee daemon with an information-disclosure vulnerability caused by improper access control. The issue allows local disclosure without extra execution privileges and does not require user interaction. Patch ALPS06419017 (Issue ALPS06284104) is noted; no other remediation ...

CVE-2022-20160

CVE-2022-20160 is documented as a critical remote code execution (RCE) vulnerability in Google Pixel devices, specifically affecting the Modem component. Public records classify it as a Modem-related issue (RCE, Critical) in the Pixel bulletin, with the Android patch level 2022-06-05 or later add...

CVE-2022-20165

CVE-2022-20165 affects the Android kernel component asn1_parse in asn1.c, where an incorrect bounds check can cause an out-of-bounds read. The consequence is local information disclosure with system execution privileges potentially required. The CVE is described as requiring no user interaction a...

CVE-2022-20177

CVE-2022-20177 affects the Android kernel. The vulnerability is in the Android kernel component of Android OS (no vendor/product details beyond Android kernel provided). NVD CVSS scores indicate CVSS v2 base score 5.0 (MEDIUM) with network attack vector, minimal impact on confidentiality as Parti...

CVE-2022-20185

CVE-2022-20185 affects the Android kernel with a use-after-free flaw described as enabling local privilege escalation to SYSTEM (LOCAL exploit, LOW attack complexity, no user interaction). The exact affected Android versions, patch level, and remediation are not provided in the supplied documents...

CVE-2022-20251

The CVE-2022-20251 issue affects Android 13 and involves LocaleManager. It enables a local attacker to determine whether a given app is installed without query permissions via a side-channel information disclosure, leading to potential local information exposure with no extra execution privileges...

CVE-2022-20404

CVE-2022-20404 is listed in Pixel bulletin data as affecting Android devices via the Modem component (Type: Information disclosure; Severity: Moderate). The vulnerable entry maps to CVE-2022-20404 with Android kernel context in the initial doc, but Pixel security bulletin categorizes it under the...

CVE-2022-20519

CVE-2022-20519 affects Android 13 in the AddAppNetworksActivity.java onCreate path. The root cause is a missing permission check that could let a guest user configure WiFi networks, enabling local elevation of privilege. Exploitation requires local access; no extra user interaction is needed. No ...

CVE-2022-20521

CVE-2022-20521 concerns a Bluetooth DoS in Android 13 caused by a missing null check in sdpu_find_most_specific_service_uuid (sdp_utils.cc). The vulnerability can crash Bluetooth, leading to local denial of service with no additional privileges required; exploitation requires user interaction. Do...

CVE-2022-20577

CVE-2022-20577 affects the Android kernel component involved in the OemSimAuthRequest::encode function in wlandata.cpp, where a missing bounds check allows an out‑of‑bounds write. This can lead to local escalation of privilege with System privileges required; exploitation reportedly does not requ...

CVE-2022-24929

Summary: CVE-2022-24929 affects Samsung AppLock (Android) prior to SMR Mar-2022 Release 1, where an unprotected Activity allows an attacker to change the list of locked apps without authentication. Affected component: AppLock on Samsung Android devices (unprotected activity in AppLock). Root caus...

CVE-2022-25816

CVE-2022-25816 affects Samsung Lock and Mask apps setting prior to the SMR Mar-2022 Release 1, where improper authentication allows an attacker to change enable/disable without authentication. The initial entry documents this vulnerability and notes Samsung and Red Hat/other vendor advisories ali...

CVE-2022-42501

CVE-2022-42501 involves an out-of-bounds write in HexString2Value within util.cpp. The vulnerability affects Android kernel components and can enable local escalation of privilege with System execution privileges, without user interaction. Exploitation details, affected versions, and remediation ...

CVE-2022-42514

CVE-2022-42514 affects Android kernel code: ProtocolImsBuilder::BuildSetConfig in protocolimsbuilder.cpp is vulnerable to an out-of-bounds read due to a missing bounds check. This could allow local information disclosure with System-level privileges required. The vulnerability is documented acros...

CVE-2023-20992

CVE-2023-20992 concerns a potential out-of-bounds read in the Android Bluetooth stack, specifically in on_iso_link_quality_read within btm_iso_impl.h. The flaw can enable local information disclosure on affected devices (Android 13) with System execution privileges, and exploitation does not requ...

CVE-2023-21030

The CVE-2023-21030 entry describes a memory corruption vulnerability due to a double free in keystore_cli_v2.cpp, enabling local privilege escalation in Android 13 with no user interaction required. Affected software in the connected data includes Google Pixel security advisories and Pixel bullet...

CVE-2023-21048

CVE-2023-21048 affects Android kernel (nan.cpp, handleEvent). Root cause: missing bounds check causing out-of-bounds read. Impact: local information disclosure with SYSTEM privileges required; no user interaction. Exploitation status is not detailed in the provided documents. Mitigation reference...

CVE-2023-21060

CVE-2023-21060 affects the Android kernel, specifically in sms_GetTpPiIe within sms_PduCodec.c. The issue is an out-of-bounds read caused by a missing bounds check, enabling potential remote information disclosure with no extra execution privileges and no user interaction. Documented impact is in...

CVE-2023-21175

CVE-2023-21175 affects Android 13 and the DataUsageSummary.java component. In onCreate, a permissions bypass could let a guest user enable/disable mobile data, enabling local privilege escalation with no extra execution privileges and no user interaction needed. Exploitation details are not elabo...

CVE-2023-21356

CVE-2023-21356 relates to Bluetooth on Android devices, where a missing bounds check can cause an out-of-bounds write in the Bluetooth stack. The underlying root cause is this unchecked memory access, enabling possible remote code execution from an adjacent attacker without user interaction and w...

CVE-2023-35692

CVE-2023-35692 affects Google Pixel devices, tied to GeoLocation.java (getLocationCache). The root cause is improper input validation that could allow sending a mock location during an emergency call. Impact is local privilege escalation without extra execution privileges, with no user interactio...

CVE-2024-20042

A security vulnerability exists in MediaTek chips within the da module due to a missing boundary check . This flaw can result in an out-of-bounds write , potentially allowing for local escalation of privilege with System execution privileges required. Exploitation does not require user interactio...

CVE-2024-32902

CVE-2024-32902 affects Google Pixel devices, tied to the modem component, and is described as a DoS leading to remote denial of cellular service via malformed packets. The issue is categorized as high severity with network attack vector and low complexity. Pixel security bulletin indicates a patc...

CVE-2024-47022

CVE-2024-47022 affects Google Pixel devices running Android prior to the 2024-10-05 patch level, with the ACPM component (A-331255656) identified as the vulnerable element. The Red Hat and CNVD entries corroborate the same information disclosure issue, described as an information leak stemming fr...

CVE-2025-0075

A use after free vulnerability exists in the sdp_server.cc file within the process_service_search_attr_req function of the sdp server component in Google Android . This flaw allows for remote code execution (RCE) without requiring additional execution privileges or user interaction. While the imp...

CVE-2025-0086

Google Android is affected by a local information disclosure vulnerability in the AccountManagerService component. The root cause is a missing permission check within the onResult function of AccountManagerService.java , which allows an attacker to overwrite an authentication token . This exploit...

CVE-2015-3106

Adobe Flash Player contains a use-after-free vulnerability (CVE-2015-3106) that allows arbitrary code execution via unspecified vectors. Affected products include Flash Player before 13.0.0.292 and 14.x up to 18.x before 18.0.0.160 on Windows/macOS, and before 11.2.202.466 on Linux; Adobe AIR bef...

CVE-2017-7759

Firefox for Android prior to version 54 is affected by CVE-2017-7759, where Android intent URLs can cause navigation from HTTP/HTTPS to local file: URLs, potentially exposing local data due to a same-origin policy violation. The issue is fixed in Firefox 54 (as noted in mfsa2017-15). Affected pro...

CVE-2018-9402

CVE-2018-9402: A buffer overwrite in multiple functions of gl_proc.c due to a missing bounds check could lead to kernel privilege escalation. The issue is documented across several sources (NVD/Red Hat CNVD/CNNVD/CIRCL and related Android Pixel bulletin context) with no exploitation details provi...

CVE-2018-9564

CVE-2018-9564 affects Android via an out-of-bounds read in llcp_util_parse_link_params (llcp_util.cc), caused by a missing bounds check. This can lead to local information disclosure without executing user-supplied code. Affected Android versions include 7.0–9 (Android-7.0, 7.1.1, 7.1.2, 8.0, 8.1...

CVE-2019-9365

CVE-2019-9365 corresponds to a Bluetooth deserialization bug in Android 10 that can enable remote code execution with network access and no user interaction. Affected component is Bluetooth deserialization in Android 10; root cause is missing string validation during deserialization, leading to R...

CVE-2020-0445

CVE-2020-0445 is an Android vulnerability described as an out-of-bounds write caused by a missing bounds check. Connected sources indicate this affects the Android video encoder (MediaTek components) and is rated high to critical, with a network attack vector and no user interaction required per ...

CVE-2021-39750

CVE-2021-39750 is an Android Elevation of Privilege issue where missing permission checks in PackageManager could allow an attacker to change the splash screen theme of other apps, leading to local privilege escalation. Connected sources (CNVD-2022-26771) reference the root cause as an absence of...

CVE-2021-39757

CVE-2021-39757 affects Android 12L with a permission bypass in the PermissionController caused by unsafe PendingIntent, enabling local information disclosure. Exploitation requires low privileges and no user interaction, with potential access to sensitive data on the device as described in multip...

CVE-2021-39774

CVE-2021-39774 affects Android 12L Bluetooth. The issue is an out-of-bounds read due to a missing bounds check, enabling local DoS with no user interaction required. Android 12L security release notes indicate this vulnerability is addressed as part of the Android 12L patch set, with devices prot...

CVE-2021-39775

CVE-2021-39775 is an Android 12L information-disclosure vulnerability describing a side-channel that lets an app determine whether another app is installed without query permissions. Affected component: Android framework/People context; root cause: side-channel information disclosure enabling loc...

CVE-2021-39788

CVE-2021-39788 affects Android 12L TelecomManager. The issue enables a side-channel information disclosure that allows checking whether a specific self-managed phone account is registered on the device, leading to local information disclosure without additional privileges and without user interac...

CVE-2022-20030

CVE-2022-20030 affects the vow driver; vulnerability is an out-of-bounds write caused by a stack-based buffer overflow. This can allow local escalation of privileges to System with no user interaction required. The advisory notes a patch identified as ALPS05837793 (Issue ALPS05837793) for remedia...

CVE-2022-20043

CVE-2022-20043 relates to a Bluetooth escalation-of-privilege vulnerability caused by a missing permission check that enables local privilege escalation without user interaction. The entry notes no additional execution privileges are required. Reported fixes reference Patch ID ALPS06148177 and Is...

CVE-2022-20049

CVE-2022-20049 affects the vpu component and describes a missing permission check that can enable local privilege escalation with System execution privileges required. Exploitation does not require user interaction. A patch is referenced (ALPS05954679; ALPS05954679). Connected sources confirm thi...