CVE-2024-20033

CVE-2024-20033 concerns a missing bounds check in the nvram module of MediaTek-based components, enabling local information disclosure that requires SYSTEM/privilege level for exploitation. The documented impact is information disclosure with no user interaction; no exploit vectors are provided i...

CVE-2024-20034

CVE-2024-20034 affects MediaTek battery module, with a missing bounds check that could enable local privilege escalation to System level. The vulnerability relies on no user interaction and has a network-style CVSS base with high impact across confidentiality, integrity, and availability, though ...

CVE-2024-29742

The CVE-2024-29742 issue is a local information-disclosure vulnerability in the Linux kernel component dvfs.c, specifically in apply_minlock_constraint, caused by a missing bounds check that enables an out-of-bounds read. Exploitation requires local access with no user interaction and could allow...

CVE-2024-29782

CVE-2024-29782 : A vulnerability in the tmu_get_tr_num_thresholds function of tmu.c can trigger an out-of-bounds read due to a missing bounds check, enabling local information disclosure without extra privileges or user interaction. Documents consistently describe the root cause and impact withou...

CVE-2024-47025

The CVE-2024-47025 issue is a local information-disclosure in the function ppmp_protect_buf of drm_fw.c. The underlying logic error could allow disclosure of sensitive data without extra privileges, with no user interaction required. Pixel/Android bulletins indicate affected devices can be patche...

CVE-2024-53839

CVE-2024-53839 arises from an out-of-bounds read in the Android kernel/user-space component, specifically in the GetCellInfoList() implementation of protocolnetadapter.cpp . The missing bounds check can enable a local attacker to cause information disclosure, with exploitation claimed to require ...

CVE-2024-53841

CVE-2024-53841 describes a potential permission bypass due to a confused deputy in Android’s startListeningForDeviceStateChanges, enabling local elevation of privilege with no user interaction required. The issue is categorized in the Pixel bulletin as an Elevation of Privilege (EoP) affecting th...

CVE-2025-0083

CVE-2025-0083 is an information-disclosure vulnerability affecting Google Android, caused by URI double encoding that allows cross-profile content access without extra privileges. The issue is referenced across multiple sources (Android Android framework/system entries in the 2025 Android bulleti...

CVE-2026-0164

CVE-2026-0164 affects Modem with an out-of-bounds write due to a missing bounds check, enabling remote code execution without extra privileges or user interaction. The vulnerability is classified as RCE with high impact on confidentiality, integrity, and availability. Public sources (NVD/ENISA/NV...

CVE-2015-5575

Technical details for CVE-2015-5575 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2015-6575

Technical details for CVE-2015-6575 are not publicly available in the provided documents; monitor for updates from official advisories.

CVE-2016-3862

CVE-2016-3862 affects Android mediaserver’s ExifInterface usage in media/ExifInterface.java, where improper interaction with static variables in libjhead_jni can allow remote attackers to craft a media file to trigger memory corruption or remote code execution. Impact is described as memory corru...

CVE-2017-0386

CVE-2017-0386 describes an elevation of privilege in the libnl library that could allow a local malicious application to execute arbitrary code within the context of a privileged process on Android. Affected products/versions include Android 5.0.2–7.1 (as listed). The impact is local code executi...

CVE-2017-0477

CVE-2017-0477 is a remote code execution vulnerability in libgdx used by Android. A specially crafted file could cause arbitrary code execution within the context of an unprivileged process, with impact described as High. The vulnerability entry notes affected product/version as Android 7.1.1 and...

CVE-2017-13321

The CVE-2017-13321 issue affects Android’s SensorService::isDataInjectionEnabled in frameworks/native/services/sensorservice/SensorService.cpp, where a missing bounds check can cause an out-of-bounds read. This leads to local information disclosure with no user interaction and without additional ...

CVE-2018-9380

CVE-2018-9380 affects Google Pixel devices via out-of-bounds write in l2c_lcc_proc_pdu() within l2c_fcr.cc, caused by improper input validation. The vulnerability can enable remote privilege escalation with no extra execution privileges required, and exploitation requires user interaction. Public...

CVE-2018-9449

The CVE-2018-9449 entry concerns Google Pixel/Nexus Android devices. The vulnerability is in the SDP discovery path, specifically the function process_service_search_attr_rsp in sdp_discovery.cc, where a missing bounds check can cause an out-of-bounds read. This leads to local information disclos...

CVE-2019-2130

CVE-2019-2130 affects Android: the issue is in CompilationJob::FinalizeJob of compiler.cc, caused by type confusion that can enable remote code execution with no user interaction. Exploitation could escalate privileges via a crafted malicious proxy configuration. Affected Android versions include...

CVE-2019-9346

CVE-2019-9346 affects the Android Media Framework (libstagefright). The issue is a heap buffer overflow causing an out-of-bounds write, enabling remote code execution. Exploitation requires user interaction. Affected product/version: Android 10. Root cause: out-of-bounds write in a heap-allocated...

CVE-2020-0048

CVE-2020-0048 affects Android 10 Media Framework (IAudioFlinger.cpp). The root cause is an information leak due to uninitialized data in onTransact, enabling local information disclosure without extra privileges or user interaction. The risk is described as a local information disclosure vulnerab...

CVE-2020-27066

CVE-2020-27066 involves a use-after-free in the Linux kernel’s xfrm6_tunnel_free_spi (net/ipv6/xfrm6_tunnel.c) caused by improper locking, enabling local privilege escalation with system execution privileges required and no user interaction. Affected context from connected docs includes Android k...

CVE-2021-0986

CVE-2021-0986 affects Android 12 via a logic error in DevicePolicyManagerService hasGrantedPolicy, enabling local information disclosure about the device owner/profile owner/device admin without extra privileges or user interaction. Exploitation is local; impact is partial confidentiality loss an...

CVE-2021-0998

CVE-2021-0998 affects Android 12 in the media/ih264e path: the function ih264e_find_bskip_params() in ih264e_me.c can trigger an out-of-bounds read due to a heap buffer overflow, enabling local information disclosure without user interaction. Exploitation details and impact are described in multi...

CVE-2021-25479

CVE-2021-25479 affects the Exynos CP Chipset. The issue is a heap-based buffer overflow in the chipset before SMR Oct-2021 Release 1, leading to arbitrary memory writes and potential code execution. The primary documented impact is memory corruption with potential device compromise; exploitation ...

CVE-2021-39679

CVE-2021-39679 affects Android kernel graphics handling (vendor_graphicbuffer_meta.cpp). The issue is a race condition leading to a possible use-after-free, enabling local escalation of privilege without extra execution privileges, and not requiring user interaction. Documentation consistently de...

CVE-2021-39751

CVE-2021-39751 affects Android 12L due to a missing permission check in Settings that allows reading Bluetooth device names without proper permissions. The vulnerability enables local information disclosure without requiring user interaction or elevated privileges, relying on an attacker with loc...

CVE-2021-39790

CVE-2021-39790 affects Android 12L Dialer. The issue arises from a missing permission check in the Dialer component, enabling local elevation of privilege. Exploitation requires user interaction, and successful abuse could grant elevated privileges on the device. The vulnerability is classified a...

CVE-2022-20062

In CVE-2022-20062, the issue is a memory corruption via a use-after-free in the mdp component. The root cause is use-after-free leading to local escalation of privileges with System execution privileges required. No user interaction is needed for exploitation. Patch ID: ALPS05836418 (Issue ID: AL...

CVE-2022-20077

The CVE-2022-20077 entry concerns a race-condition-based memory corruption in vow that could enable local privilege escalation to SYSTEM, with no user interaction required. Affected context and root cause are described consistently across multiple sources (e.g., Red Hat, NVD, CVE lists, PRION/CVE...

CVE-2022-20089

The CVE-2022-20089 issue concerns the MediaTek aee driver where a memory corruption vulnerability is triggered by active debug code. The flaw could enable local privilege escalation to SYSTEM with no user interaction required. Affected component: aee driver; root cause: memory corruption from deb...

CVE-2022-20243

CVE-2022-20243 affects Google Android’s Core Utilities on Android 13. The issue enables local information disclosure of sensitive browsing data and requires System execution privileges; no user interaction is needed. The provided data show a Medium base CVSS 3.1 score (AV:L/AC:L/PR:H/UI:N/S:U/C:H...

CVE-2022-20507

The CVE-2022-20507 issue affects Android 13 in the UWB stack, specifically UwbEventManager.java’s onMulticastListUpdateNotificationReceived. The root cause is a missing bounds check that can enable arbitrary code execution, enabling local privilege escalation with no user interaction required. CV...

CVE-2022-20509

CVE-2022-20509 affects Android 13 in the code path mapGrantorDescr of MessageQueueBase.h, where a missing bounds check can cause an out-of-bounds write. This could enable local escalation of privilege to SYSTEM with no user interaction, requiring local access and high privileges. The Pixel bullet...

CVE-2022-20512

CVE-2022-20512 affects Android 13 via an input validation flaw in Task.java: navigateUpTo can launch an intent with a mismatched intent, enabling local elevation of privilege without user interaction. The issue is documented in Google’s Pixel bulletin; patch level 2022-12-05 (and related Android-...

CVE-2022-20544

CVE-2022-20544 affects Android 13; a missing permission check in onOptionsItemSelected of ManageApplications.java could bypass profile owner restrictions, enabling local elevation of privilege without additional execution privileges or user interaction. The issue is documented across multiple sou...

CVE-2022-20554

CVE-2022-20554 affects Android 13 in Pixel devices. The vulnerability arises from an out-of-bounds read caused by a use-after-free in the function removeEventHubDevice within InputDevice.cpp. This leads to local elevation of privilege with System execution privileges required, and exploitation do...

CVE-2022-21751

CVE-2022-21751 affects the WLAN driver and is caused by a missing bounds check leading to an out-of-bounds write. The issue can enable local escalation to SYSTEM privileges with no user interaction required. The vulnerability is associated with the MediaTek/ALPS patch ALPS06511132 (Issue ID ALPS0...

CVE-2022-21783

CVE-2022-21783 affects MediaTek WLAN driver and is caused by a missing bounds check that enables an out-of-bounds write. This leads to local privilege escalation with SYSTEM execution privileges required and no user interaction. Public references (including Red Hat/RedHat-affiliated postings and ...

CVE-2022-21787

CVE-2022-21787 affects MediaTek audio DSP components. The root cause is a missing bounds check that allows an out-of-bounds write, enabling local escalation of privilege with System execution privileges. Exploitation does not require user interaction. A patch is referenced as ALPS06558844 (Issue ...

CVE-2022-26090

Summary of CVE-2022-26090 : The vulnerability affects SamsungContacts prior to SMR Apr-2022 Release 1, caused by an improper access control error that could allow attackers to access contact information without permission. The issue is documented across multiple sources, with remediation advising...

CVE-2022-26096

CVE-2022-26096 describes a null pointer dereference in the parser_ispe function of the libsimba library prior to Samsung SMR Apr-2022 Release 1. The flaw permits a remote attacker to cause an out-of-bounds write. Connected documents consistently identify the affected component as libsimba and the...

CVE-2022-26434

CVE-2022-26434 describes an out-of-bounds write in the mailbox caused by a missing bounds check, enabling local escalation to System privileges without user interaction. Public references across NVD/Red Hat and related feeds identify the patch ID ALPS07138450 (Issue ALPS07138450) as the remediati...

CVE-2022-33716

CVE-2022-33716 affects ICCC TA prior to SMR Aug-2022 Release 1. The issue is an absence of variable initialization in ICCC TA, enabling a local attacker to read uninitialized memory. Red‑hat and PT/security databases corroborate: affected versions are ICCC TA before SMR Aug-2022 Release 1. Remedi...

CVE-2022-38684

The CVE-2022-38684 entry describes a vulnerability in the Contacts service caused by a missing permission check, enabling local denial of service with no additional privileges required. The connected documents corroborate the core issue (missing permission validation) and the local impact, but do...

CVE-2022-39913

CVE-2022-39913 concerns the Exposure of Sensitive Information to an Unauthorized Actor in Samsung’s Persona Manager prior to Android T(13). The issue arises from a data exposure that allows a local attacker to access user profiles information. Affected product/area: Persona Manager on devices run...

CVE-2022-42524

The CVE-2022-42524 entry describes an out-of-bounds read in Android’s sms_GetTpUdlIe within sms_PduCodec.c due to a missing bounds check. This can lead to remote information disclosure without extra privileges or user interaction. Connected OSV data confirms the same file-level bug, but no exploi...

CVE-2023-20908

CVE-2023-20908 affects Android releases 10–13, with a DoS in SettingsState.java that can cause a system crash loop through resource exhaustion. Exploitation is local with no user interaction; available CVSS vectors indicate local, low complexity, low privileges, high availability impact. The prim...

CVE-2023-20981

CVE-2023-20981 affects Android 13 as described in multiple sources. The vulnerability is located in the Bluetooth stack function btu_ble_rc_param_req_evt in btu_hcif.cc , where a missing bounds check allows an out-of-bounds read. This can lead to local information disclosure and requires System-l...

CVE-2023-21014

CVE-2023-21014 affects Android 13 where in multiple locations of p2p_iface.cpp a missing bounds check can cause an out-of-bounds read. This leads to local information disclosure and could enable system-level privileges to be exploited locally; no user interaction is required. The vulnerability is...

CVE-2023-21024

Summary of CVE-2023-21024: Android 13 devices with FallbackHome.java’s maybeFinish logic error may delay the lockdown screen, enabling local escalation of privilege without extra execution privileges or user interaction. The issue is documented across multiple sources (NVD, Red Hat, RH, OSV) with...