CVE-2024-53838

CVE-2024-53838 stems from an incorrect bounds check in Exynos_parsing_user_data_registered_itu_t_t35 within VendorVideoAPI.cpp, causing an out-of-bounds write. The flaw enables local privilege escalation with no additional execution privileges required and does not require user interaction. Affec...

CVE-2025-0093

CVE-2025-0093 affects the Android Bluetooth stack, with a root cause in AdapterService.java: handleBondStateChanged missing a permission check, enabling information disclosure without extra execution privileges. Exploitation requires user interaction; impact is information disclosure via Bluetoot...

CVE-2025-20696

CVE-2025-20696 pertains to MediaTek DA, where a missing bounds check enables an out-of-bounds write that could lead to local privilege escalation on affected devices. The issue requires physical access and, per the description, user interaction is needed for exploitation. Affected component/versi...

CVE-2025-22405

CVE-2025-22405 is an Android elevation-of-privilege vulnerability described as a use-after-free in multiple locations that could enable local code execution with no user interaction. Public sources/connected documents note this CVE as an EoP issue with high severity affecting Android components; ...

CVE-2026-0055

CVE-2026-0055 describes a path traversal in PackageInstallerService.java (createSessionInternal) that could let an attacker place or move a Device Policy Controller (DPC) into an invalid directory, enabling local privilege escalation without extra execution privileges or user interaction. The det...

CVE-2011-3881

CVE-2011-3881 affects WebKit as used in Google Chrome <15.0.874.102 and Android

CVE-2012-4220

CVE-2012-4220 / CVE-2012-4221 affect the Qualcomm DIAG kernel-mode driver for Android 2.3–4.2. diagchar_core.c (CVE-2012-4220) and diagchar_core.c with an untrusted pointer dereference (CVE-2012-4221) allow a local application to exploit crafted arguments via diagchar_ioctl to execute arbitrary c...

CVE-2016-0802

CVE-2016-0802 affects the Broadcom Wi‑Fi kernel driver, vulnerable in Android 4.x up to 4.4.3/4.4.4, 5.x up to 5.1.x, and 6.x up to 2016-02-01. An unauthenticated, adjacent attacker can send crafted wireless control message packets to trigger memory corruption, leading to remote code execution or...

CVE-2016-0809

CVE-2016-0809 is a use-after-free in the wifi_cleanup function of Broadcom’s Wi‑Fi driver (bcmdhd/wifi_hal/wifi_hal.cpp) used by Android 6.x. The issue could allow local privilege escalation when an attacker with physical access executes a crafted app. Affected: Android 6.x prior to 2016-02-01. R...

CVE-2016-5348

CVE-2016-5348 affects the GPS component in Android, dating from 4.x up to 7.0, where a man-in-the-middle can trigger memory exhaustion and a DoS by sending a large xtra.bin/xtra2.bin from spoofed gpsonextra.net or izatcloud.net hosts. Root cause is malformed/overlarge GPS data files processed by ...

CVE-2017-0424

CVE-2017-0424 affects AOSP Messaging in Android (versions 6.0–7.1.1). It is an information disclosure vulnerability that could allow a local malicious app to bypass OS protections and access data outside its permitted scope when processing a specially crafted file. The issue is described as a mod...

CVE-2017-0604

CVE-2017-0604 concerns Android devices with the Qualcomm power driver in the kernel. The flaw enables a local malicious application to gain elevation of privilege and execute arbitrary code in the kernel context, implying potential local compromise that could require reflashing to repair. The lin...

CVE-2017-0809

The CVE-2017-0809 entry describes a remote code execution vulnerability in the Android media framework (libstagefright). Affected product: Android. Vulnerable component/file: Android’s media framework library libstagefright. Root cause: remote attacker could craft a file to trigger code execution...

CVE-2017-13292

CVE-2017-13292 is a remote code execution vulnerability in the Broadcom bcmdhd Wi‑Fi driver affecting Android; root cause is an out-of-bounds write in wl_get_assoc_ies within wl_cfg80211.c due to an incorrect bounds check. This could allow an attacker to execute arbitrary code in the context of a...

CVE-2017-14904

CVE-2017-14904 affects Android’s libgralloc/MediaServer path. A crafted binder request can cause an arbitrary unmap in MediaServer, enabling sandbox escape and, per ThreatPost, could allow code injection into system_server via a malicious URL in Chrome. Exploitation details in sources describe an...

CVE-2018-11987

CVE-2018-11987 describes a vulnerability affecting all CAF Android releases that use the Linux kernel. In boot, an unlikely memory allocation failure in the secure pool can cause a wrong-pointer access, potentially leading to a kernel panic. The affected surface is the secure pool management duri...

CVE-2018-9414

CVE-2018-9414 affects Google Pixel/Android Bluetooth stack. The issue is in the native function gattServerSendResponseNative (com_android_bluetooth_gatt.cpp), where a missing bounds check allows an out-of-bounds stack write. This can lead to local elevation of privilege with user execution privil...

CVE-2018-9466

CVE-2018-9466 : A vulnerability in libxml2’s valid.c xmlSnprintfElementContent can cause an out-of-bounds write, enabling remote escalation of privilege in an unprivileged process with user interaction required. Public details across sources confirm the issue’s presence in libxml2 and describe th...

CVE-2019-2065

CVE-2019-2065 affects the Android 10 libxaac library, where a missing bounds check enables an out-of-bounds write. This could permit remote code execution over the network with user interaction required. Connected Red Hat and CNVD entries confirm the same description. No concrete patch/version is...

CVE-2019-2117

The CVE-2019-2117 issue affects Android (7.0–9) and is tied to TelephonyProvider.java. The root cause is a missing permission check in checkQueryPermission, leading to local information disclosure about carrier systems without requiring privileges or user interaction. Impact is information disclo...

CVE-2020-13838

CVE-2020-13838 affects Samsung mobile devices running P (9.0) and Q (10.0) software, where the DeX Lockscreen fails to block access to the Quick Panel and notifications. The issue is documented across multiple sources (NVD entry and Red Hat advisory) without details on a concrete exploit vector o...

CVE-2020-26602

CVE-2020-26602 affects Samsung mobile devices (EthernetNetwork component) on Android 8.1–11.0. The issue allows an unprivileged process with PendingIntent to access the SD card. This can enable unintended data exposure and potential abuse of card access through networked interaction. Root cause: ...

CVE-2021-0562

The CVE-2021-0562 entry corresponds to an information disclosure flaw in Android 11 related to RasterIntraUpdate in motion_est.cpp. The root cause is an out-of-bounds read caused by an incorrect bounds check, allowing local information disclosure without extra execution privileges. Affected compo...

CVE-2021-0572

CVE-2021-0572 affects Android 11 with a vulnerability in AccountManagerService.doNotification where an unsafe PendingIntent allows a local permission bypass and potential local information disclosure. Exploitation requires no user interaction and privileges are potentially low with local access. ...

CVE-2021-0939

CVE-2021-0939 affects the Android kernel, description states: in set_default_passthru_cfg of passthru.c there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with system privileges required; user interaction not needed. The provided ...

CVE-2021-1005

CVE-2021-1005 affects Android 12, involving getDeviceIdWithFeature in PhoneInterfaceManager.java. The issue enables a local information disclosure via a side-channel that can reveal whether an app is installed without query permissions, with no user interaction required. The description and conne...

CVE-2021-1031

CVE-2021-1031 : Android 12’s NotificationManagerService.cancelNotificationsFromListener can indirectly determine whether an app is installed via a side‑channel information disclosure, enabling local information disclosure without additional execution privileges. The issue is documented with a LOW...

CVE-2021-25336

CVE-2021-25336 affects Samsung mobile devices via improper access control in NotificationManagerService. The root cause is insufficient access checks that allow untrusted applications to obtain notification access by sending a crafted malicious intent. Documented impact is limited to exploitation...

CVE-2021-25362

CVE-2021-25362 affects Samsung CertInstaller prior to SMR APR-2021 Release 1. Root cause: improper permission management that lets untrusted apps delete certain local files. Impact varies by metric/version (CVSS3.1: LOCAL, LOW integrity, HIGH availability; CVSS2: LOCAL, PARTIAL integrity, PARTIAL...

CVE-2021-39642

CVE-2021-39642 affects the Android kernel component, specifically the function synchronous_process_io_entries in lwis_ioctl.c . The issue is a race condition that enables a possible out-of-bounds write, leading to local elevation of privileges with System-level execution rights required. No user ...

CVE-2021-39771

CVE-2021-39771 is an Elevation of Privilege (EoP) in Android 12L Platform related to improper input validation in Settings, allowing a local attacker to misrepresent which app adds a Wi‑Fi network. Impact is Moderate per Android 12L release notes; exploitation requires user interaction. The vulne...

CVE-2022-20555

CVE-2022-20555 affects Android 13. The issue is in ufdt_get_node_by_path_len of ufdt_convert.c, where a missing bounds check can cause an out-of-bounds read. This leads to local information disclosure with System execution privileges required; no user interaction is needed for exploitation. Publi...

CVE-2022-21776

The CVE-2022-21776 issue is a race-condition triggered use-after-free in MediaTek’s MDP component leading to local privilege escalation with SYSTEM rights, no user interaction required. Multiple sources (NVD entry, Red Hat advisory, CNVD/CNNVD summaries) corroborate the same root cause and impact...

CVE-2022-25831

CVE-2022-25831 affects Samsung S Secure prior to SMR Apr-2022 Release 1 and is an improper access control vulnerability, enabling physical attackers to access secured data under certain conditions. The connected documents identify the affected component as S Secure and indicate the remediation pa...

CVE-2022-26431

CVE-2022-26431 affects the MediaTek mailbox controller and is described as an out-of-bounds write caused by a missing bounds check. The issue could allow local escalation of privilege to System level with no user interaction required. Documented impact is high for confidentiality, integrity, and ...

CVE-2022-27825

The CVE-2022-27825 vulnerability affects the libsapeextractor library, specifically the sapefd_parse_meta_HEADER function. A faulty size check can allow an out-of-bounds read when processing a crafted media file. This issue is addressed in Samsung SMR Apr-2022 Release 1 (patch package), mitigatin...

CVE-2022-32595

CVE-2022-32595 affects Widevine with an out-of-bounds read caused by an incorrect bounds check. This vulnerability could lead to local information disclosure; the impact is described as high for confidentiality, with system-level execution privileges needed and no user interaction required. The a...

CVE-2022-42515

CVE-2022-42515: In MiscService::DoOemSetRtpPktlossThreshold (miscservice.cpp), a missing bounds check enables an out-of-bounds read. Impact: local information disclosure with system privileges; exploitation requires local access and no user interaction. Affected: Android kernel components (rild_e...

CVE-2023-20618

The CVE-2023-20618 vulnerability affects the MediaTek vcu component, where memory corruption can occur due to improper locking. This can enable local privilege escalation to System execution level without user interaction. The security entry lists Patch ID ALPS07519184 (Issue ALPS07519184) as the...

CVE-2023-20715

CVE-2023-20715 affects the wlan component in MediaTek-based devices. The issue is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privileges with SYSTEM execution rights required. Exploitation reportedly does not require user interaction. The vulnerability’s ...

CVE-2023-20740

The CVE-2023-20740 issue affects the vcu component in certain MediaTek-based devices, caused by a logic error that can trigger memory corruption. This can lead to local escalation of privilege with SYSTEM privileges and does not require user interaction. A patch (ALPS07559819) is referenced as a ...

CVE-2023-20743

The CVE-2023-20743 issue affects the vcu module in MediaTek chips. It stems from improper locking that enables an out-of-bounds write, potentially allowing local escalation of privilege to SYSTEM level without user interaction. The vulnerability impact is described as high for confidentiality, in...

CVE-2023-20746

The CVE-2023-20746 entry details a vulnerability in the vcu component of MediaTek chips. Root cause: an out-of-bounds write caused by improper locking. Impact: local escalation of privilege to SYSTEM level with no user interaction required. Affected scope is limited to the vcu module; exploitatio...

CVE-2023-20995

CVE-2023-20995 concerns a logic error in the Fingerprint workflow within Android 13. In code path captureImage of CustomizedSensor.cpp, the flaw can bypass fingerprint unlock, enabling local elevation of privilege without additional execution privileges and without user interaction. Affected prod...

CVE-2023-21003

CVE-2023-21003 is described across multiple sources as a local elevation of privilege in Android 13 related to the getAvailabilityStatus path of several Transcode Permission Controllers. The root cause is a missing permission check, allowing a user with LOW privileges to bypass protections with n...

CVE-2023-21011

CVE-2023-21011 affects Android 13 on Pixel devices, with vulnerable code in p2p_iface.cpp due to a missing bounds check that can cause an out-of-bounds read. This may lead to local information disclosure with system privileges required; exploitation does not require user interaction. Multiple con...

CVE-2023-21012

CVE-2023-21012 affects Android 13 (Pixel devices) with an out-of-bounds read in p2p_iface.cpp caused by a missing bounds check, leading to possible local information disclosure and requiring system privileges for exploitation. The vulnerability description states no user interaction is needed. Pu...

CVE-2023-21193

CVE-2023-21193 is a vulnerability in Android 13 where the VideoFrame component in VideoFrame.h can abort due to an integer overflow, potentially enabling remote information disclosure without user interaction. The CVE is listed in multiple sources (NVD, Red Hat, PRION, OSV) with the same basic de...

CVE-2024-47019

CVE-2024-47019 affects Google Pixel devices via a buffer/read bounds issue in ProtocolEmbmsSaiListAdapter::Init() inside protocolembmsadapter.cpp. The vulnerability is an out-of-bounds read caused by a missing bounds check, potentially leading to local information disclosure and baseband firmware...

CVE-2024-56187

CVE-2024-56187 involves a logic error in Google Pixel’s ppcfw_deny_sec_dram_access (ppcfw.c) that allows an arbitrary read of TEE memory, enabling local information disclosure with System privileges and no user interaction required. Affected: Pixel devices; root cause: logic flaw in memory access...