CVE-2023-20618

The CVE-2023-20618 vulnerability affects the MediaTek vcu component, where memory corruption can occur due to improper locking. This can enable local privilege escalation to System execution level without user interaction. The security entry lists Patch ID ALPS07519184 (Issue ALPS07519184) as the...

CVE-2023-20811

CVE-2023-20811 involves a boundary-check failure in the MediaTek IOMMU, causing an out-of-bounds write that could enable local privilege escalation with system privileges. Affected component: IOMMU sub-system (MediaTek). Root cause: missing bounds check leading to out-of-bounds write. Impact: loc...

CVE-2023-20995

CVE-2023-20995 concerns a logic error in the Fingerprint workflow within Android 13. In code path captureImage of CustomizedSensor.cpp, the flaw can bypass fingerprint unlock, enabling local elevation of privilege without additional execution privileges and without user interaction. Affected prod...

CVE-2023-20996

CVE-2023-20996 affects Android 13 (Pixel devices) and is described as a DoS via an input validation flaw that can trigger a persistent reboot loop. The vulnerability enables local denial of service with no user interaction required and requires user privileges. Public details confirm the issue is...

CVE-2023-21003

CVE-2023-21003 is described across multiple sources as a local elevation of privilege in Android 13 related to the getAvailabilityStatus path of several Transcode Permission Controllers. The root cause is a missing permission check, allowing a user with LOW privileges to bypass protections with n...

CVE-2023-21042

CVE-2023-21042 corresponds to a memory corruption issue via a use-after-free in lwis_allocator_init (lwis_allocator.c) within the Android kernel’s lwis subsystem. This could enable local privilege escalation to SYSTEM with no user interaction required. The OSV entry PUB-A-239873326 confirms the u...

CVE-2023-21045

CVE-2023-21045 affects the Android kernel cpif handling of probe failures. The vulnerability arises from an out-of-bounds read caused by a use-after-free, enabling local information disclosure with SYSTEM privileges; exploitation requires no user interaction. Multiple connected sources (NVD, Red ...

CVE-2023-21066

CVE-2023-21066 describes a heap buffer overflow in the Android kernel, specifically in the cd_CodeMsg function of cd_codec.c. This causes an out-of-bounds write that could enable remote code execution with no privileges and no user interaction required. The vulnerability is documented across mult...

CVE-2023-21185

CVE-2023-21185 affects Android 13 devices, where multiple functions in WifiNetworkFactory.java lack a required permission check. This creates a path for local privilege escalation from a guest user, with no additional execution privileges and no user interaction required to exploit. Public source...

CVE-2023-21200

CVE-2023-21200 documents an out-of-bounds read in on_remove_iso_data_path() of btm_iso_impl.h on Android 13, caused by improper input validation. This can enable local information disclosure without extra execution privileges or user interaction (per NVD metrics: LOCAL access, LOW privileges, no ...

CVE-2023-21294

CVE-2023-21294 concerns Android’s Slice component, where a missing permission check enables local information disclosure by exposing installed packages. The exploit requires no user interaction and does not require additional privileges. The connected sources reiterate the same description but do...

CVE-2023-21348

The CVE-2023-21348 entry concerns Android Window Manager side-channel leakage that allows an app to be detected as installed without query permissions, causing local information disclosure. Connected sources corroborate the issue as an information-disclosure vulnerability (Framework category) wit...

CVE-2024-20053

CVE-2024-20053 affects the flashc component. The vulnerability is an out-of-bounds write caused by an uncaught exception, enabling local escalation of privileges with System-level execution privileges required. User interaction is not required. A patch is referenced (ALPS08541757; ALPS08541764). ...

CVE-2024-20054

A security vulnerability exists in the gnss module of MediaTek chips due to a missing bounds check . This flaw can lead to a local escalation of privilege , requiring System execution privileges for exploitation. Notably, user interaction is not required to trigger the vulnerability. Remediation ...

CVE-2024-39433

CVE-2024-39433 affects UNISOC/drm service components in chipsets and is associated with a missing bounds check, causing an out-of-bounds write that can lead to local denial of service with System execution privileges. The connected sources confirm the vulnerable component (drm service) and the im...

CVE-2024-44101

CVE-2024-44101 is a DoS vulnerability affecting Google Pixel devices’ Modem, caused by a Null Pointer Dereference from improper input validation. Exploitation requires no user interaction and is modeled as network-accessible with high impact (remote DoS). Public details across sources confirm the...

CVE-2024-47019

CVE-2024-47019 affects Google Pixel devices via a buffer/read bounds issue in ProtocolEmbmsSaiListAdapter::Init() inside protocolembmsadapter.cpp. The vulnerability is an out-of-bounds read caused by a missing bounds check, potentially leading to local information disclosure and baseband firmware...

CVE-2024-53834

The Google Android operating system is vulnerable to an out-of-bounds read due to an incorrect boundary check in the sms_DisplayHexDumpOfPrivacyBuffer function within the sms_Utilities.c file. This vulnerability could allow an attacker to perform remote information disclosure without requiring ad...

CVE-2025-20696

A security vulnerability exists in DA within MediaTek Chipsets due to a missing bounds check . This flaw allows for a possible out-of-bounds write , which could result in local escalation of privilege . Exploitation requires physical access to the device and user interaction , but no additional e...

CVE-2025-22405

In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22432

A security vulnerability exists in Google Android within the System component, specifically in the notifyTimeout function of CallRedirectionProcessor.java . The flaw stems from improper input validation , which could allow for a persistent connection . This vulnerability may lead to local escalat...

CVE-2026-0055

CVE-2026-0055 describes a path traversal in PackageInstallerService.java (createSessionInternal) that could let an attacker place or move a Device Policy Controller (DPC) into an invalid directory, enabling local privilege escalation without extra execution privileges or user interaction. The det...

CVE-2011-3881

CVE-2011-3881 affects WebKit as used in Google Chrome <15.0.874.102 and Android

CVE-2012-4220

CVE-2012-4220 / CVE-2012-4221 affect the Qualcomm DIAG kernel-mode driver for Android 2.3–4.2. diagchar_core.c (CVE-2012-4220) and diagchar_core.c with an untrusted pointer dereference (CVE-2012-4221) allow a local application to exploit crafted arguments via diagchar_ioctl to execute arbitrary c...

CVE-2014-7915

The CVE relates to an integer overflow in SampleTable.cpp of Android’s libstagefright (Android before 5.0.0; some references extend to related 4.x/5.x lines). The root cause is an integer overflow in SampleTable.cpp in libstagefright, leading to unspecified impact per early descriptions, with fol...

CVE-2015-3874

CVE-2015-3874 affects the Sonivox components in Android prior to 5.1.1 LMY48T, allowing remote attackers to execute arbitrary code or cause memory corruption via a crafted media file. The issue is listed in the Android 2015-10-01 bulletin as a remote-code-execution vulnerability in mediaserver-re...

CVE-2016-0802

CVE-2016-0802 affects the Broadcom Wi‑Fi kernel driver, vulnerable in Android 4.x up to 4.4.3/4.4.4, 5.x up to 5.1.x, and 6.x up to 2016-02-01. An unauthenticated, adjacent attacker can send crafted wireless control message packets to trigger memory corruption, leading to remote code execution or...

CVE-2016-0809

CVE-2016-0809 is a use-after-free in the wifi_cleanup function of Broadcom’s Wi‑Fi driver (bcmdhd/wifi_hal/wifi_hal.cpp) used by Android 6.x. The issue could allow local privilege escalation when an attacker with physical access executes a crafted app. Affected: Android 6.x prior to 2016-02-01. R...

CVE-2016-5348

CVE-2016-5348 affects the GPS component in Android, dating from 4.x up to 7.0, where a man-in-the-middle can trigger memory exhaustion and a DoS by sending a large xtra.bin/xtra2.bin from spoofed gpsonextra.net or izatcloud.net hosts. Root cause is malformed/overlarge GPS data files processed by ...

CVE-2017-0424

CVE-2017-0424 affects AOSP Messaging in Android (versions 6.0–7.1.1). It is an information disclosure vulnerability that could allow a local malicious app to bypass OS protections and access data outside its permitted scope when processing a specially crafted file. The issue is described as a mod...

CVE-2017-0604

CVE-2017-0604 concerns Android devices with the Qualcomm power driver in the kernel. The flaw enables a local malicious application to gain elevation of privilege and execute arbitrary code in the kernel context, implying potential local compromise that could require reflashing to repair. The lin...

CVE-2017-0809

The CVE-2017-0809 entry describes a remote code execution vulnerability in the Android media framework (libstagefright). Affected product: Android. Vulnerable component/file: Android’s media framework library libstagefright. Root cause: remote attacker could craft a file to trigger code execution...

CVE-2017-13292

CVE-2017-13292 is a remote code execution vulnerability in the Broadcom bcmdhd Wi‑Fi driver affecting Android; root cause is an out-of-bounds write in wl_get_assoc_ies within wl_cfg80211.c due to an incorrect bounds check. This could allow an attacker to execute arbitrary code in the context of a...

CVE-2017-14904

CVE-2017-14904 affects Android’s libgralloc/MediaServer path. A crafted binder request can cause an arbitrary unmap in MediaServer, enabling sandbox escape and, per ThreatPost, could allow code injection into system_server via a malicious URL in Chrome. Exploitation details in sources describe an...

CVE-2018-11987

CVE-2018-11987 describes a vulnerability affecting all CAF Android releases that use the Linux kernel. In boot, an unlikely memory allocation failure in the secure pool can cause a wrong-pointer access, potentially leading to a kernel panic. The affected surface is the secure pool management duri...

CVE-2018-9414

CVE-2018-9414 affects Google Pixel/Android Bluetooth stack. The issue is in the native function gattServerSendResponseNative (com_android_bluetooth_gatt.cpp), where a missing bounds check allows an out-of-bounds stack write. This can lead to local elevation of privilege with user execution privil...

CVE-2019-2117

The CVE-2019-2117 issue affects Android (7.0–9) and is tied to TelephonyProvider.java. The root cause is a missing permission check in checkQueryPermission, leading to local information disclosure about carrier systems without requiring privileges or user interaction. Impact is information disclo...

CVE-2020-13838

CVE-2020-13838 affects Samsung mobile devices running P (9.0) and Q (10.0) software, where the DeX Lockscreen fails to block access to the Quick Panel and notifications. The issue is documented across multiple sources (NVD entry and Red Hat advisory) without details on a concrete exploit vector o...

CVE-2020-26602

CVE-2020-26602 affects Samsung mobile devices (EthernetNetwork component) on Android 8.1–11.0. The issue allows an unprivileged process with PendingIntent to access the SD card. This can enable unintended data exposure and potential abuse of card access through networked interaction. Root cause: ...

CVE-2021-0538

CVE-2021-0538 affects Android 11 via EmergencyCallbackModeExitDialog.java, where a tapjacking/overlay attack can exit emergency callback mode, enabling local elevation of privilege with user interaction required. Documented impact: local EoP with high likelihood of access via exposed UI flow; CVS...

CVE-2021-0562

The CVE-2021-0562 entry corresponds to an information disclosure flaw in Android 11 related to RasterIntraUpdate in motion_est.cpp. The root cause is an out-of-bounds read caused by an incorrect bounds check, allowing local information disclosure without extra execution privileges. Affected compo...

CVE-2021-0572

CVE-2021-0572 affects Android 11 with a vulnerability in AccountManagerService.doNotification where an unsafe PendingIntent allows a local permission bypass and potential local information disclosure. Exploitation requires no user interaction and privileges are potentially low with local access. ...

CVE-2021-0939

CVE-2021-0939 affects the Android kernel, description states: in set_default_passthru_cfg of passthru.c there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with system privileges required; user interaction not needed. The provided ...

CVE-2021-1005

CVE-2021-1005 affects Android 12, involving getDeviceIdWithFeature in PhoneInterfaceManager.java. The issue enables a local information disclosure via a side-channel that can reveal whether an app is installed without query permissions, with no user interaction required. The description and conne...

CVE-2021-1031

CVE-2021-1031 : Android 12’s NotificationManagerService.cancelNotificationsFromListener can indirectly determine whether an app is installed via a side‑channel information disclosure, enabling local information disclosure without additional execution privileges. The issue is documented with a LOW...

CVE-2021-25336

CVE-2021-25336 affects Samsung mobile devices via improper access control in NotificationManagerService. The root cause is insufficient access checks that allow untrusted applications to obtain notification access by sending a crafted malicious intent. Documented impact is limited to exploitation...

CVE-2021-25362

CVE-2021-25362 affects Samsung CertInstaller prior to SMR APR-2021 Release 1. Root cause: improper permission management that lets untrusted apps delete certain local files. Impact varies by metric/version (CVSS3.1: LOCAL, LOW integrity, HIGH availability; CVSS2: LOCAL, PARTIAL integrity, PARTIAL...

CVE-2021-26687

The CVE-2021-26687 entry concerns LG mobile devices running Android 8–10 where the HostnameVerified default is mishandled in preloaded applications. Connected sources confirm the affected platform (LG Android devices) and the root cause: mishandling of HostnameVerified in preloaded apps, which ca...

CVE-2021-39642

CVE-2021-39642 affects the Android kernel component, specifically the function synchronous_process_io_entries in lwis_ioctl.c . The issue is a race condition that enables a possible out-of-bounds write, leading to local elevation of privileges with System-level execution rights required. No user ...

CVE-2021-39771

CVE-2021-39771 is an Elevation of Privilege (EoP) in Android 12L Platform related to improper input validation in Settings, allowing a local attacker to misrepresent which app adds a Wi‑Fi network. Impact is Moderate per Android 12L release notes; exploitation requires user interaction. The vulne...