CVE-2024-20051

In flashc, an uncaught exception can cause a system crash, enabling local denial of service with system execution privileges required. No user interaction is needed. A patch is referenced (ALPS08541757; ALPS08541758).

CVE-2024-20128

CVE-2024-20128 affects MediaTek Telephony components (Telephony in MediaTek chipsets). The issue is an out-of-bounds read due to a missing bounds check, which could allow remote denial of service without user interaction. Impact is described as high (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) per CVSS ...

CVE-2023-21180

This CVE (CVE-2023-21180) affects Android 13. The issue is a heap buffer overflow in xmlParseTryOrFinish within parser.c, causing an out-of-bounds read. This can lead to remote information disclosure without exploit privileges and without user interaction. The publicly described mitigation refere...

CVE-2023-21189

CVE-2023-21189 affects Android 13 (Pixel devices) via a logic error in startLockTaskMode within LockTaskController.java that can bypass lock task mode, enabling local privilege escalation with only user interaction required. The vulnerability is documented across multiple sources (NVD, Red Hat, P...

CVE-2023-21403

CVE-2023-21403 affects Google Android via the PowerVR-GPU driver entry (rgxta3d.c: RGXDestroyZSBufferKM). The root cause is an uncaught exception in RGXDestroyZSBufferKM that can lead to arbitrary code execution, resulting in local kernel elevation of privilege without requiring user interaction....

CVE-2023-48415

CVE-2023-48415 concerns an out-of-bounds read in Init of protocolembmsadapter.cpp caused by a missing bounds check. Per multiple connected documents, this can lead to local information disclosure without requiring user interaction. The issue is associated with Android/Google Pixel components (inc...

CVE-2024-11624

CVE-2024-11624 affects Google Android (notably Pixel) and is categorized as an Elevation of Privilege (VPN) vulnerability. The issue arises from an undeclared permission that allows adding apps to bypass VPN, enabling local privilege elevation with no extra execution privileges and no user intera...

CVE-2024-29754

CVE-2024-29754 affects Google Pixel/Android components via TMU_IPC_GET_TABLE. The issue is an out-of-bounds read caused by a missing bounds check, leading to local information disclosure without requiring user interaction. Exploitation details are not provided in the sources; no explicit impacted...

CVE-2024-29781

CVE-2024-29781: A possible out-of-bounds read in ss_AnalyzeOssReturnResUssdArgIe of ss_OssAsnManagement.c could enable remote information disclosure without authentication or user interaction. Documented impact is information disclosure (no integrity/availability impact stated). In Pixel/Android ...

CVE-2024-32893

The CVE-2024-32893 issue affects the Exynos DVFS code path (exynos_dvfs.c) specifically in _s5e9865_mif_set_rate. The flaw is an out-of-bounds read caused by improper casting, leading to local information disclosure without requiring user interaction. Multiple connected sources (including RH/Red ...

CVE-2024-32899

CVE-2024-32899 relates to a race condition in the Pixel GPU power management path (gpu_pm_power_off_top_nolock in pixel_gpu_power.c) that could allow local escalation of privilege to the TEE by compromising protected memory. Exploitation is predicted to require with local access and no user inter...

CVE-2025-22412

CVE-2025-22412 is a use-after-free in multiple functions of sdp_server.cc that enables remote code execution with no privileges and no user interaction. Public sources (NVD/NIST entry) describe the flaw as a logic error freeing memory, leading to remote code execution on affected Android platform...

CVE-2025-22413

The vulnerability CVE-2025-22413 affects the Android kernel (hyp-main.c) where a logic error can allow local privilege escalation and information disclosure without extra privileges or user interaction. The issue is described consistently across multiple sources (Linux kernel context in Android, ...

CVE-2025-32318

CVE-2025-32318: A heap buffer overflow in Skia can cause an out-of-bounds write, enabling remote elevation of privilege with no user interaction. CVSSv3.1: 8.8 (Network, Low evidence required, Privileges Low, Confidentiality/Integrity/Availability High). Android 16 security notes classify this en...

CVE-2015-5572

Adobe Flash Player and related Adobe AIR components are affected by CVE-2015-5572, a security bypass that allows information disclosure by bypassing intended access restrictions. The vulnerability affects Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X, and before 11...

CVE-2015-5584

Technical details about CVE-2015-5584 are not publicly provided in the connected documents. The initial description lists affected products/versions but no concrete exploit/vulnerability details. Monitor for updates from advisories.

CVE-2015-5588

Technical details about CVE-2015-5588 are not publicly provided in the connected documents. No affected product/version/impact is specified here. Monitor for updates in the EUVD advisories and official vendor bulletins.

CVE-2015-6677

Technical details about CVE-2015-6677 are not provided in the connected documents. The supplied sources do not reveal affected products, vulnerable components, exploit information, or remediation. Monitor for updates and await published technical specifics.

CVE-2017-0599

CVE-2017-0599 is a remote denial-of-service vulnerability in Android’s Mediaserver, specifically the libhevc component. A specially crafted media file could cause a device hang or reboot. Affected products/versions in the provided documents: Android 6.0–7.1.2. The description in the connected sou...

CVE-2017-0760

CVE-2017-0760 is a remote code execution vulnerability in the Android media framework (libstagefright) affecting Android 6.0–6.0.1 and 7.0–7.1.2. The issue is described as a vulnerability in the Media Framework that could allow code execution, with the Android bulletin noting that the most severe...

CVE-2019-9406

CVE-2019-9406 affects libhevc in Android 10. The vulnerability enables information disclosure via uninitialized data within the Media/Video processing path, potentially allowing remote information disclosure without extra execution privileges. Exploitation is described as requiring user interacti...

CVE-2020-0052

CVE-2020-0052 affects Android 10 where In smsSelected of AnswerFragment.java an elevation-of-privilege vulnerability exists due to a permissions bypass that allows sending an SMS from the lock screen. The issue enables local privilege escalation with no extra execution privileges required; exploi...

CVE-2021-0555

CVE-2021-0555 affects Android 11 with a vulnerability in RenderStruct of protostream_objectsource.cc where a missing null check can cause a remote Denial of Service. The Red Hat and NVD entries confirm the issue’s root cause and impact; Pixel bulletin mappings show this CVE is classified as DoS (...

CVE-2021-0565

CVE-2021-0565 is a local elevation-of-privilege issue in Android 11 related to wrapUserThread in AudioStream.cpp. The vulnerability arises from a race condition causing a use-after-free, enabling local privilege escalation without user interaction. Documented impact is limited to Android-11/audio...

CVE-2021-0983

CVE-2021-0983 affects Android 12L in the DevicePolicyManagerService.createAdminSupportIntent, enabling local information disclosure of the installed device/profile owner package name via a side-channel. Exploitation requires no user interaction and does not require additional privileges; impact i...

CVE-2021-39754

Technical details about CVE-2021-39754 are not publicly disclosed in the provided connected documents. Monitor for updates.

CVE-2021-39778

CVE-2021-39778 affects Android 12L Telecomm, where improper input validation can reveal whether an app is installed, leading to local information disclosure without privileges. Affected component: Telecomm in Android Framework; root cause: input validation flaw exposing install-state. Impact: inf...

CVE-2022-20068

CVE-2022-20068 affects MediaTek devices where the vulnerable component is the mobile_log_d process, due to improper link resolution allowing symbolic link following. The issue could enable local escalation of privilege with System execution privileges required, and exploitation does not require u...

CVE-2022-20085

CVE-2022-20085 affects MediaTek netdiag components. The issue is improper link resolution leading to symbolic link following, enabling local privilege escalation with System privileges required; no user interaction is needed. Patch ID ALPS06308877 (Issue ALPS06308877) is noted as remediation. Pub...

CVE-2022-20102

The CVE-2022-20102 issue affects the aee daemon and stems from a missing permission check, enabling local information disclosure with System privileges. Exploitation requires no user interaction. The NVD reports CVSSv3.1 base score 4.4 (Local, Privileges Required: High, Confidentiality Impact: Hi...

CVE-2022-20286

CVE-2022-20286 affects Android 13 under the Connectivity component. A logic error can bypass the restriction on starting activities from the background, potentially enabling local privilege escalation with user privileges and no user interaction required. Documented impact: local elevation of pri...

CVE-2022-20516

CVE-2022-20516 affects Android 13 via rw_t3t_act_handle_check_ndef_rsp in rw_t3t.cc. The issue is an integer overflow that can cause an out-of-bounds read, potentially enabling remote information disclosure without privileges or user interaction. Exploitation details are not provided in the suppl...

CVE-2022-20549

CVE-2022-20549 affects Android 13 (Pixel). Root cause: out-of-bounds write in authToken2AidlVec within KeyMintUtils.cpp caused by an incorrect bounds check. Impact: local escalation of privilege with System execution privileges required; no user interaction needed. Exploitation details and fixes ...

CVE-2022-20574

CVE-2022-20574 involves the Android kernel’s DRM firmware path, specifically the function sec_sysmmu_info in drm_fw.c. The issue is an out-of-bounds read caused by improper input validation, enabling local information disclosure without additional privileges and without user interaction. Document...

CVE-2022-20593

CVE-2022-20593 affects the Android kernel, involving an out-of-bounds read in the function pop_descriptor_string of BufferDescriptor.h due to a missing bounds check. This condition could allow local information disclosure and requires only local privileges (no user interaction needed). The vulner...

CVE-2022-20598

CVE-2022-20598 describes an integer overflow in the Android kernel’s sec_media_protect function (media.c). The issue can cause a local Elevation of Privilege in the secure mode MFC Core, with no additional privileges or user interaction required. The available documents specify the vulnerability ...

CVE-2022-24001

CVE-2022-24001 describes an information-disclosure flaw in the Android Edge Panel feature, prior to Android S(12). The vulnerability allows a physical attacker to access screenshots stored in the clipboard via Edge Panel. Documents consistently refer to the Edge Panel since the CVE description; n...

CVE-2022-25833

The CVE-2022-25833 entry concerns Samsung SMR prior to Apr-2022 Release 1, where improper authentication in ImsService could allow an attacker to obtain IMSI without the READ_PRIVILEGED_PHONE_STATE permission. The vulnerability involves authentication checks in ImsService, enabling local access t...

CVE-2022-42513

CVE-2022-42513 : A missing bounds check in ProtocolEmbmsBuilder::BuildSetSession (protocolembmsbuilder.cpp) allows an out-of-bounds write in the Android kernel, enabling local escalation of privilege to SYSTEM level. No user interaction is required. Documented in multiple sources (e.g., NVD entry...

CVE-2023-20838

CVE-2023-20838 concerns the imgsys component. Multiple connected sources confirm a race-condition–driven out-of-bounds read that can leak local information and, in some scenarios, enable system-level execution with user interaction required for exploitation. Affected references consistently descr...

CVE-2023-20979

CVE-2023-20979 corresponds to a buffer/read out-of-bounds issue in GetNextSourceDataPacket() of bta_av_co.cc on Android 13. The underlying cause is a missing bounds check, enabling local information disclosure with no user interaction and no extra privileges. In practice, exploits are not detaile...

CVE-2023-21068

The CVE-2023-21068 entry concerns Android kernel with a local privilege escalation via booting with a hidden debug policy due to a missing user warning. Affected component is the Android kernel; description states that after preparing the device and hiding the warning, a user can hand the device ...

CVE-2023-21192

CVE-2023-21192 affects Android 13 and is tied to InputMethodManagerService.setInputMethodWithSubtypeIdLocked, where improper input validation can allow configuring input methods that are not enabled, leading to local elevation of privilege without extra user interaction. The vulnerability descrip...

CVE-2023-21213

CVE-2023-21213 affects Android-13 (sta_iface.cpp, initiateTdlsTeardownInternal): a missing bounds check leads to an out-of-bounds read in the wifi server, enabling local information disclosure with System privileges and no user interaction required. Multiple connected sources reiter the same root...

CVE-2023-21314

CVE-2023-21314 is a Bluetooth-related information-disclosure vulnerability in Android, caused by a missing bounds check that allows an out-of-bounds read. The impact is local information disclosure with system-level privileges required for exploitation; no user interaction is needed. Multiple con...

CVE-2023-21389

CVE-2023-21389 concerns a bypass of profile owner restrictions in Android Settings due to a missing permission check, enabling local elevation of privilege without extra execution privileges and without user interaction. Multiple connected sources describe this as an Android elevation-of-privileg...

CVE-2024-29751

CVE-2024-29751 describes a possible out-of-bounds read in the function asn1_ec_pkey_parse_p384 (asn1_common.c) caused by a missing null check, enabling local information disclosure with no extra privileges or user interaction. Multiple sources tie this to OpenSSL (PT-2024-22991) and list it under...

CVE-2024-32918

CVE-2024-32918 describes a permission bypass that allows attackers to disable HDCP 2.2 encryption by not completing the HDCP Key Exchange initialization steps. The vulnerability is referenced in multiple feeds as affecting Google Pixel/Android devices, with references to a Trusty/TEE subcomponent...

CVE-2024-32924

Technical details (affected products, versions, root cause specifics, or exploitation details) are not publicly provided in the supplied documents. Monitor for updates from Red Hat/NVD/Android Bulletins for concrete fixes or mitigations.

CVE-2024-44098

Summary: CVE-2024-44098 affects the LWIS component in lwis_event.c (Google Pixel). The issue is a double-free leading to a possible local privilege escalation with no required user interaction. The risk assessment is supported by multiple sources indicating Elevation of Privilege (EoP) concerns, ...