CVE-2023-20845

CVE-2023-20845 affects imgsys. The vulnerability is an out-of-bounds read caused by missing valid range checking, leading to local information disclosure with system execution privileges required and user interaction for exploitation. Patch ID ALPS07197795 / Issue ID ALPS07340357 is associated wi...

CVE-2023-21011

CVE-2023-21011 affects Android 13 on Pixel devices, with vulnerable code in p2p_iface.cpp due to a missing bounds check that can cause an out-of-bounds read. This may lead to local information disclosure with system privileges required; exploitation does not require user interaction. Multiple con...

CVE-2023-21012

CVE-2023-21012 affects Android 13 (Pixel devices) with an out-of-bounds read in p2p_iface.cpp caused by a missing bounds check, leading to possible local information disclosure and requiring system privileges for exploitation. The vulnerability description states no user interaction is needed. Pu...

CVE-2023-21033

CVE-2023-21033 is a DoS vulnerability affecting Android 13 where the issue resides in WifiManager.addNetwork. The root cause is a resource-exhaustion condition that can trigger a persistent DoS without requiring additional privileges or user interaction, and it is local in scope. Documented detai...

CVE-2023-21046

CVE-2023-21046 affects the Android kernel (aidl_utils.cc, ConvertToHalMetadata). The bug is an out-of-bounds read caused by an incorrect bounds check, leading to possible local information disclosure with system privileges required; exploitation is LOCAL with LOW complexity and does not require u...

CVE-2023-21076

CVE-2023-21076 involves a possible out-of-bounds write due to a heap buffer overflow in the function createTransmitFollowupRequest within nan.cpp. The underlying issue is a heap buffer overflow that could enable a local escalation of privilege with System execution privileges required. Exploitati...

CVE-2023-21125

Google Android is subject to an elevation of privilege vulnerability caused by a use after free in the btif_hh_hsdata_rpt_copy_cb function within bta_hh.cc. An attacker can exploit this memory corruption to gain higher privileges over Bluetooth locally. The vulnerability does not require addition...

CVE-2023-21220

Technical details about CVE-2023-21220 are not publicly provided in the supplied documents. Information about affected components, root cause, and fixes is not disclosed here. Monitor for updates.

CVE-2023-21223

CVE-2023-21223 affects Android kernel via an out-of-bounds read in LPP_ConvertGNSS_DataBitAssistance (LPP_CommonUtil.c) caused by a missing bounds check. This enables remote information disclosure with no privileges or user interaction required. Impact and exploitability are described in multiple...

CVE-2023-21294

CVE-2023-21294 concerns Android’s Slice component, where a missing permission check enables local information disclosure by exposing installed packages. The exploit requires no user interaction and does not require additional privileges. The connected sources reiterate the same description but do...

CVE-2023-35653

CVE-2023-35653 affects Google Pixel devices in the ImsService component. The issue is an information-disclosure via a permissions bypass that could allow access to location information; exploitation is feasible with local access and requires System-level privileges with no user interaction. The P...

CVE-2023-48397

CVE-2023-48397: Out-of-bounds read in Init of protocolcalladapter.cpp allows information disclosure with potential for System-level impact. The issue requires no user interaction. Documented in multiple sources (NVD entry and Android Pixel bulletin) with Pixel subcomponent exynos-ril and a CVSS v...

CVE-2023-52341

A security vulnerability exists in UNISOC Chipsets (from China's Purple Spreadtrum) due to a possible missing permission check in Plaintext COUNTER CHECK messages accepted before AS security activation. This flaw could lead to remote information disclosure without requiring additional execution p...

CVE-2024-20034

A security vulnerability exists in the battery module of MediaTek chips due to a missing bounds check . This flaw could allow for a local escalation of privilege , requiring System execution privileges for exploitation. No user interaction is required. While a patch ID (ALPS08488849 ) and issue I...

CVE-2024-20058

MediaTek chips are affected by an out-of-bounds read vulnerability in the keyInstall module caused by a missing bounds check. This flaw could lead to local information disclosure and requires System execution privileges to exploit, with no user interaction required. Remediation is addressed under...

CVE-2024-20060

A security vulnerability exists in MediaTek chips within the da module due to an incorrect status check . This flaw allows for a local escalation of privilege requiring System execution privileges, where user interaction is not required. While specific affected versions are not provided, a patch ...

CVE-2026-0041

A vulnerability exists in the Google Android operating system within the ubsan_throwing_runtime.cpp file. The issue is caused by an integer overflow in multiple functions, which can lead to a remote denial of service (DoS). This vulnerability can be exploited without additional execution privileg...

CVE-2026-0092

The CVE-2026-0092 entry is tied to the Android Package Manager and describes a device lock controller bypass caused by a missing permission check. The underlying issue enables local escalation of privilege with no extra execution privileges and requires no user interaction. The impact is describe...

CVE-2015-5568

CVE-2015-5568 affects Adobe Flash Player and related AIR components. Public docs confirm this vulnerability is part of the APSB15-23 set and is tied to a vector-length corruption that could enable a denial of service or other impact. Affected software and versions per the sources include: Windows...

CVE-2015-5575

Technical details for CVE-2015-5575 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2015-6647

CVE-2015-6647 is a privilege-escalation in the Widevine QSEE TrustZone app on Android. A crafted app exploiting QSEECOM access could grant elevated privileges on devices running Android 5.x before 5.1.1 LMY49F and Android 6.0 before 2016-01-01. Mitigation/fixes are provided by Android patches: An...

CVE-2017-0411

CVE-2017-0411 is an elevation-of-privilege vulnerability in the Android Framework APIs that could let a local malicious application execute arbitrary code within a privileged process. Affected product: Android (Framework APIs). Vulnerable versions (per initial entry): Android 7.0 and 7.1.1 (Andro...

CVE-2017-0475

Technical details about CVE-2017-0475 are not publicly provided in the supplied documents. Monitor for updates from Android security bulletins and vendor advisories.

CVE-2017-0477

CVE-2017-0477 is a remote code execution vulnerability in libgdx used by Android. A specially crafted file could cause arbitrary code execution within the context of an unprivileged process, with impact described as High. The vulnerability entry notes affected product/version as Android 7.1.1 and...

CVE-2017-0523

CVE-2017-0523 is an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver that could allow a local malicious app to execute arbitrary code in the kernel. The CVSS3 vector indicates LOCAL access, high complexity, no privileges required, but user interaction is required; root cause is e...

CVE-2017-0764

CVE-2017-0764 is a remote code execution in Android’s media framework (libvorbis). Affected Android versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. The root cause is a flaw in media processing by libvorbis that could be exploited via a crafted file. CVSS3/ATT&CK context from th...

CVE-2017-13262

CVE-2017-13262 is an Android Bluetooth vulnerability in the BNEP path (bnep_data_ind in bnep_main.cc) where a missing length decrement causes an out-of-bounds read. This can enable remote information disclosure without user interaction. Affected Android versions include 5.1.1 through 8.1. Public ...

CVE-2018-6268

CVE-2018-6268 affects NVIDIA Tegra libnvmmlite_video.so, where a use-after-free can cause DoS or privilege escalation. Connected NVIDIA bulletins tie this to Jetson TX1/TX2 Linux for Tegra (L4T) and list R28.3 as the updated release to address multiple related flaws, including 2018-6268. Affected...

CVE-2020-0087

CVE-2020-0087 affects Android 10 (framework). The issue is in ActivityManagerService.getProcessPss, enabling a side-channel information disclosure with local access and requiring user interaction to exploit. The vulnerability’s impact is partial information disclosure (high confidentiality impact...

CVE-2020-0187

CVE-2020-0187 affects Android 10 where in engineSetMode of BaseBlockCipher.java a comparison error could permit information disclosure without extra privileges. Documents confirm the vulnerability type as information disclosure with local access required, and no user interaction. Public reference...

CVE-2021-0462

CVE-2021-0462 concerns the NXP NFC firmware used in Google Pixel devices. A logic error could allow an insecure firmware update, enabling local elevation of privilege with system-level execution privileges, and exploitation does not require user interaction. The issue is tied to the NFC firmware ...

CVE-2021-0552

CVE-2021-0552 affects Android on Android-11 via the MediaOutputSlice.java getEndItemSliceAction path. The root cause is an unsafe PendingIntent that enables a permission bypass, leading to potential information disclosure with local attack practicality. The vulnerability is categorized as an info...

CVE-2021-0973

CVE-2021-0973 affects Android 12 and involves a flaw in isFileUri in UriUtil.java that allows bypassing the ignoring of file:// URIs due to improper case-sensitive handling. The issue can lead to local information disclosure with no additional privileges required, and exploitation requires user i...

CVE-2021-1032

CVE-2021-1032 affects Android 12 and is tied to getMimeGroup in PackageManagerService.java. The issue enables a side-channel disclosure that can reveal whether an app is installed without any query permissions, constituting a local information disclosure. Exploitation requires no user interaction...

CVE-2021-39679

CVE-2021-39679 affects Android kernel graphics handling (vendor_graphicbuffer_meta.cpp). The issue is a race condition leading to a possible use-after-free, enabling local escalation of privilege without extra execution privileges, and not requiring user interaction. Documentation consistently de...

CVE-2021-39745

CVE-2021-39745 affects Android 12L and is described in multiple feeds as a side-channel information disclosure in DevicePolicyManager that could let an attacker determine whether an app is installed without query permissions. The vulnerability enables local information disclosure with no addition...

CVE-2021-39751

CVE-2021-39751 affects Android 12L due to a missing permission check in Settings that allows reading Bluetooth device names without proper permissions. The vulnerability enables local information disclosure without requiring user interaction or elevated privileges, relying on an attacker with loc...

CVE-2021-39776

The Android 12L release notes list CVE-2021-39776 under the System category with Type EoP and High severity, indicating an elevation-of-privilege issue. The notes do not provide explicit technical details, affected subcomponents beyond class, or exploit vectors. Affected product/version is Androi...

CVE-2022-20062

In CVE-2022-20062, the issue is a memory corruption via a use-after-free in the mdp component. The root cause is use-after-free leading to local escalation of privileges with System execution privileges required. No user interaction is needed for exploitation. Patch ID: ALPS05836418 (Issue ID: AL...

CVE-2022-20087

The CVE-2022-20087 issue concerns MediaTek ccu (camera control processor) where a missing bounds check allows an out-of-bounds write, enabling local privilege escalation with System execution privileges required. No user interaction is needed for exploitation. Documented impact is confined to loc...

CVE-2022-20089

The CVE-2022-20089 issue concerns the MediaTek aee driver where a memory corruption vulnerability is triggered by active debug code. The flaw could enable local privilege escalation to SYSTEM with no user interaction required. Affected component: aee driver; root cause: memory corruption from deb...

CVE-2022-20507

The CVE-2022-20507 issue affects Android 13 in the UWB stack, specifically UwbEventManager.java’s onMulticastListUpdateNotificationReceived. The root cause is a missing bounds check that can enable arbitrary code execution, enabling local privilege escalation with no user interaction required. CV...

CVE-2022-20540

CVE-2022-20540 is a local-use-after-free vulnerability in Android’s SurfaceFlinger::doDump. Exploitation could permit arbitrary code execution and local escalation of privilege without user interaction. Affected: Android 13, via SurfaceFlinger component. The issue is documented across multiple fe...

CVE-2022-20546

CVE-2022-20546 affects Android 13 in the code path described by the Pixel/Effect.cpp vulnerability: a missing bounds check in the function getCurrentConfigImpl can cause an out-of-bounds write. This vulnerability is characterized as a local escalation of privilege with system execution privileges...

CVE-2022-20550

CVE-2022-20550 affects Android 13 (Pixel devices) with a local elevation of privilege caused by a confused deputy, enabling arbitrary protected activities without user interaction. Public sources (Pixel Update Bulletin 2022-12-01) associate fixes to the 2022-12-05 patch level; no explicit vulnera...

CVE-2022-21783

CVE-2022-21783 affects MediaTek WLAN driver and is caused by a missing bounds check that enables an out-of-bounds write. This leads to local privilege escalation with SYSTEM execution privileges required and no user interaction. Public references (including Red Hat/RedHat-affiliated postings and ...

CVE-2022-21787

CVE-2022-21787 affects MediaTek audio DSP components. The root cause is a missing bounds check that allows an out-of-bounds write, enabling local escalation of privilege with System execution privileges. Exploitation does not require user interaction. A patch is referenced as ALPS06558844 (Issue ...

CVE-2022-30722

CVE-2022-30722 concerns an implicit intent hijacking vulnerability in Samsung Account prior to the SMR Jun-2022 Release 1. The issue allows bypassing user confirmation by exploiting hijacking of non-privileged applications, impacting Samsung Account on Samsung devices. The available documents cit...

CVE-2022-32642

The CVE-2022-32642 issue affects the ccd component, where a race condition can cause memory corruption. This could enable local escalation of privilege with System execution privileges required and no user interaction is needed. The problem is documented across multiple sources with patch referen...

CVE-2022-39886

CVE-2022-39886 concerns an improper access control vulnerability in the IpcRxServiceModeBigDataInfo component of RIL, prior to Samsung SMR Nov-2022 Release 1. A local attacker could access device information due to the access-control weakness in RIL. Affected: Samsung devices running RIL before t...