CVE-2024-20083

The venc component in MediaTek chips is susceptible to an out-of-bounds write caused by a missing bounds check. This vulnerability could allow for local escalation of privilege with System execution privileges required, and it does not require user interaction for exploitation. Remediation is ava...

CVE-2024-29742

The Linux kernel (specifically affecting Google Android devices) contains an out-of-bounds read vulnerability in the apply_minlock_constraint function of the dvfs.c file. This issue stems from a missing bounds check , which could allow an attacker to perform local information disclosure without r...

CVE-2024-29754

The Google Pixel smartphone is affected by an out-of-bounds read vulnerability in the TMU_IPC_GET_TABLE module. This issue stems from a missing bounds check , which could allow an attacker to obtain local information disclosure without requiring additional execution privileges or user interaction...

CVE-2024-29781

CVE-2024-29781: A possible out-of-bounds read in ss_AnalyzeOssReturnResUssdArgIe of ss_OssAsnManagement.c could enable remote information disclosure without authentication or user interaction. Documented impact is information disclosure (no integrity/availability impact stated). In Pixel/Android ...

CVE-2024-32919

A type confusion vulnerability exists in the lwis_add_completion_fence function of lwis_fence.c within the LWIS component. This flaw could allow for a local escalation of privilege (EoP) without requiring additional execution privileges or user interaction. The vulnerability has been addressed in...

CVE-2024-44098

The lwis component in Google Pixel devices is vulnerable to a double free (or double release) issue in the lwis_device_event_states_clear_locked function of lwis_event.c. This flaw allows for a local escalation of privilege (EoP) without requiring additional execution privileges or user interacti...

CVE-2024-47015

A vulnerability exists in Google Pixel devices within the Exynos RIL subcomponent, specifically in the ProtocolMiscHwConfigChangeAdapter::GetData() function of protocolmiscadapter.cpp . The issue stems from a missing bounds check, leading to a possible out-of-bounds read . This could result in lo...

CVE-2024-47024

CVE-2024-47024 involves an integer overflow in vring_size within external/headers/include/virtio/virtio_ring.h, causing a possible out-of-bounds write. The impact is local escalation of privilege with no additional execution privileges required and no user interaction needed, as described across ...

CVE-2024-47027

CVE-2024-47027 affects Google Pixel/Android components, with the vulnerability in sm_mem_compat_get_vmm_obj in lib/sm/shared_mem.c. The issue allows arbitrary physical memory access due to improper input validation, enabling local privilege escalation without additional privileges or user interac...

CVE-2024-47029

The vulnerability CVE-2024-47029 affects the TrustySharedMemoryManager::GetSharedMemory implementation in ondevice/trusty/trusty_shared_memory_manager.cc. The issue is an incorrect bounds check that can trigger an out-of-bounds read, causing local information disclosure without requiring extra pr...

CVE-2025-22406

Google Android is susceptible to a memory misreference vulnerability (specifically a use after free ) within the bnep_utils.cc component. The flaw originates from a mix-up in the bnepu_check_send_packet instruction responsible for freeing memory. An attacker can exploit this to achieve code execu...

CVE-2026-28618

A heap buffer overflow in the dec_frm_prepare function of oapv.c within the OpenAPV codec allows for an out-of-bounds write. This vulnerability exists in the Media Codecs component and affects Android versions 13, 14, 15, and 16 . Exploitation can lead to remote code execution (RCE) or local priv...

CVE-2026-49881

A logic error in InCallController.java within the Android 17 Telecom service allows an unprivileged app to achieve arbitrary code execution as the UID 1000 system_server user without user interaction. The vulnerability occurs because serviceClassExists uses createPackageContext with CONTEXT_IGNOR...

CVE-2012-4220

CVE-2012-4220 / CVE-2012-4221 affect the Qualcomm DIAG kernel-mode driver for Android 2.3–4.2. diagchar_core.c (CVE-2012-4220) and diagchar_core.c with an untrusted pointer dereference (CVE-2012-4221) allow a local application to exploit crafted arguments via diagchar_ioctl to execute arbitrary c...

CVE-2015-5577

Adobe Flash Player and Adobe AIR are affected by CVE-2015-5577. Affected products include Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows/macOS, and before 11.2.202.521 on Linux, as well as Adobe AIR before 19.0.0.190 and related AIR SDK/Compiler versions. The vulnerability a...

CVE-2016-0825

The CVE-2016-0825 issue concerns the Widevine Trusted Application on Android 6.0.1 before 2016-03-01. According to the sources, an attacker with kernel access could disclose TrustZone secure-storage information, demonstrated by obtaining Signature or SignatureOrSystem permissions. The vulnerabili...

CVE-2016-10276

CVE-2016-10276 (Qualcomm bootloader) targets the Qualcomm bootloader on Android devices, enabling a local malicious app to execute arbitrary code within the kernel context (elevation of privilege). The issue is described as critical due to potential local, permanent device compromise that may req...

CVE-2017-0641

CVE-2017-0641 is a remote denial-of-service vulnerability in the libvpx Mediaserver component used by Android. A specially crafted file can cause a device to hang or reboot. Affected Android versions include 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The description does not provide ...

CVE-2017-0806

CVE-2017-0806 is an elevation of privilege in the Android framework (gatekeeperresponse). The Android bulletin and NVD entries list it as a local, user-interaction-required flaw that could enable a malicious local application to bypass user interaction requirements to gain additional permissions....

CVE-2017-13260

CVE-2017-13260 is an information disclosure flaw in Android Bluetooth’s BNEP implementation. In bnep_data_ind of bnep_main.cc, a missing bounds check enables a possible out-of-bounds read, allowing remote disclosure without user interaction. Affected Android versions include 5.1.1, 6.0, 6.0.1, 7....

CVE-2018-9380

CVE-2018-9380 affects Google Pixel devices via out-of-bounds write in l2c_lcc_proc_pdu() within l2c_fcr.cc, caused by improper input validation. The vulnerability can enable remote privilege escalation with no extra execution privileges required, and exploitation requires user interaction. Public...

CVE-2019-2010

CVE-2019-2010 concerns a local elevation of privilege in Android due to an out-of-bounds write in phNxpNciHal_ext.cc (phNxpNciHal_process_ext_rsp) caused by a missing bounds check. Affected Android versions include 7.0–9.0. The issue enables local exploitation without user interaction and with lo...

CVE-2019-2130

CVE-2019-2130 affects Android: the issue is in CompilationJob::FinalizeJob of compiler.cc, caused by type confusion that can enable remote code execution with no user interaction. Exploitation could escalate privileges via a crafted malicious proxy configuration. Affected Android versions include...

CVE-2020-0048

CVE-2020-0048 affects Android 10 Media Framework (IAudioFlinger.cpp). The root cause is an information leak due to uninitialized data in onTransact, enabling local information disclosure without extra privileges or user interaction. The risk is described as a local information disclosure vulnerab...

CVE-2020-0063

CVE-2020-0063 affects Android SurfaceFlinger, where the UI confirmation screen protected by the TEE can be overridden, enabling local elevation of privilege. Root cause: manipulation of the UI flow in SurfaceFlinger allows bypassing user interaction. Impact: local privilege escalation with high s...

CVE-2021-0563

CVE-2021-0563 affects Android 11, due to an out-of-bounds read caused by a heap buffer overflow in ih264e_fmt_conv_422i_to_420sp within ih264e_fmt_conv.c. This could enable local information disclosure without user interaction or additional privileges. Connected sources confirm the vulnerable com...

CVE-2021-0565

CVE-2021-0565 is a local elevation-of-privilege issue in Android 11 related to wrapUserThread in AudioStream.cpp. The vulnerability arises from a race condition causing a use-after-free, enabling local privilege escalation without user interaction. Documented impact is limited to Android-11/audio...

CVE-2021-0607

CVE-2021-0607 affects the Android kernel in the Knowles IAXXX adnc driver. The issue is in iaxxx_calc_i2s_div (iaxxx-codec.c) where a missing bounds check on a hardware port write allows an attacker with local access to supply data that leads to local elevation of privilege. Exploitation requires...

CVE-2021-39759

CVE-2021-39759 is an Android libstagefright vulnerability described in connected sources as a local privilege-escalation due to an integer overflow that enables an out-of-bounds write. Exploitation is possible locally without user interaction, affecting Android 12L. The issue is categorized under...

CVE-2021-39778

CVE-2021-39778 affects Android 12L Telecomm, where improper input validation can reveal whether an app is installed, leading to local information disclosure without privileges. Affected component: Telecomm in Android Framework; root cause: input validation flaw exposing install-state. Impact: inf...

CVE-2022-20002

CVE-2022-20002 affects Android 12L in incfs, where a missing permission check enables mounting on arbitrary paths. This can lead to local privilege escalation to SYSTEM with no user interaction required. The vulnerability is described with CVSSv3.1/2.0 metrics (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...

CVE-2022-20169

CVE-2022-20169 is associated with Android kernel/modem in Google Pixel devices as per the connected documents. The PRION source explicitly labels the issue as a "Code injection" vulnerability, while other documents broadly reference the Android kernel/modem context for this CVE. The exact root ca...

CVE-2022-20199

Summary: CVE-2022-20199 concerns an information disclosure in Android 13’s NfcService.java due to a confused deputy, enabling local information disclosure without extra privileges. The vulnerability is documented across multiple sources, all describing the same issue, with no exploitation details...

CVE-2022-20512

CVE-2022-20512 affects Android 13 via an input validation flaw in Task.java: navigateUpTo can launch an intent with a mismatched intent, enabling local elevation of privilege without user interaction. The issue is documented in Google’s Pixel bulletin; patch level 2022-12-05 (and related Android-...

CVE-2022-20592

CVE-2022-20592 describes a vulnerability in the Android kernel’s DRM firmware, specifically in the function ppmp_validate_secbuf of drm_fw.c. The flaw stems from improper input validation, allowing local information disclosure without requiring additional execution privileges or user interaction....

CVE-2022-20604

CVE-2022-20604 affects the Android kernel function SAECOMM_SetDcnIdForPlmn in SAECOMM_DbManagement.c. A missing bounds check causes an out-of-bounds read, enabling possible information disclosure on a single device. The CVSSv3.1 vector indicates a local, low-privilege impact with no user interact...

CVE-2022-26434

CVE-2022-26434 describes an out-of-bounds write in the mailbox caused by a missing bounds check, enabling local escalation to System privileges without user interaction. Public references across NVD/Red Hat and related feeds identify the patch ID ALPS07138450 (Issue ALPS07138450) as the remediati...

CVE-2022-26467

CVE-2022-26467 affects the rpmb component in MediaTek chips. An out-of-bounds write caused by an incorrect bounds check could enable local privilege escalation to SYSTEM with no user interaction required. The advisory references patch ALPS07167738 (Issue ALPS07167738) as a fix. Exploitation statu...

CVE-2022-27828

CVE-2022-27828 involves Samsung MediaMonitorEvent with an improper input/validation check prior to SMR Apr-2022 Release 1. The vulnerability is rated HIGH (CVSSv3.1: Local, Low attack complexity, Privileges Required: Low, No user interaction; confidentiality, integrity, and availability all high)...

CVE-2022-30753

Affected software: Samsung SecSoterService on Samsung mobile devices. Issue: improper use of a unique device ID in unprotected SecSoterService, enabling local attackers to obtain the device ID without permission. Impact: information disclosure limited to local access. Root cause: unprotected hand...

CVE-2022-33730

CVE-2022-33730 describes a heap-based buffer overflow in Samsung Dex for PC prior to SMR Aug-2022 Release 1, allowing arbitrary code execution by physical attackers. Affected: Samsung Dex for PC (pre‑SMR Aug‑2022 Release 1). Root cause: heap-based overflow in Samsung Dex for PC. Impact: potential...

CVE-2022-39885

CVE-2022-39885 affects Samsung DeviceManagement, BootCompletedReceiver_CMCC component, prior to SMR Nov-2022 Release 1. Root cause: improper access control allowing a local attacker to access device information via the BootCompletedReceiver_CMCC in DeviceManagement. Impact: local disclosure of de...

CVE-2022-42510

CVE-2022-42510 involves the Android kernel component where the function is StringsRequestData::encode in requestdata.cpp. The root cause is an out-of-bounds read caused by improper input validation, which could enable a local escalation of privilege with System execution privileges required. Expl...

CVE-2023-20840

CVE-2023-20840 affects imgsys with a possible out-of-bounds read/write caused by missing valid-range checks. Exploitation requires user interaction and can grant local escalation of privilege with system execution privileges. A patch is referenced: ALPS07326430 (Issue ALPS07326430). No additional...

CVE-2023-20850

The CVE concerns the imgsys_cmdq component in MediaTek chips, where an out-of-bounds write can occur due to missing valid range checking. This could permit local escalation of privilege with system execution privileges required, and user interaction is needed for exploitation. Documented impact i...

CVE-2023-20975

CVE-2023-20975 affects Android 13 via a permissions bypass in getAvailabilityStatus of EnableContentCapturePreferenceController.java, enabling a local privilege escalation with no user interaction. Affected vector is not exploitation details in the provided docs, but multiple sources note a DISAL...

CVE-2023-21040

CVE-2023-21040 concerns the Android kernel Bluetooth code, specifically in the function buildCommand within bluetooth_ccc.cc. The issue is a logic error that can cause an out-of-bounds write, enabling local elevation of privilege with no additional execution privileges required and with no user i...

CVE-2023-21077

CVE-2023-21077 affects the Android kernel in the rtt_unpack_xtlv_cbfn function within dhd_rtt.c, where a buffer overflow can cause an out-of-bounds write. This vulnerability could enable local escalation of privileges with SYSTEM-level execution privileges, and exploitation is possible without us...

CVE-2023-21191

CVE-2023-21191 affects Android 13 and originates from a logic error in NotificationManagerService.fixNotification, allowing a bypass of the notification hide preference that could lead to local privilege escalation with no extra execution privileges or user interaction required. Documents consist...

CVE-2023-21212

CVE-2023-21212 affects Android 13, specifically the wifi server component. The root cause is a missing bounds check leading to an out-of-bounds read, enabling local information disclosure. Exploitation status is not described in the provided documents, and there is no explicit remediation detail ...