CVE-2023-21173

CVE-2023-21173 affects Android 13 where multiple methods in DataUsageList.java can reveal admin network activity due to a missing permission check, enabling local information disclosure with no extra privileges or user interaction. The vulnerability is documented across multiple feeds (NVD, Red H...

CVE-2023-21185

CVE-2023-21185 affects Android 13 devices, where multiple functions in WifiNetworkFactory.java lack a required permission check. This creates a path for local privilege escalation from a guest user, with no additional execution privileges and no user interaction required to exploit. Public source...

CVE-2023-21187

CVE-2023-21187 affects Android 13 and is caused by a logic error in UsbAccessoryUriActivity.java onCreate that can let an attacker escape the Setup Wizard, enabling local privilege escalation with no user interaction required. Public documents consistently describe the impact as local escalation ...

CVE-2023-21207

CVE-2023-21207 affects Android 13, targeting the function initiateTdlsSetupInternal in sta_iface.cpp. It describes an out-of-bounds read due to a missing bounds check, enabling local privilege escalation to SYSTEM with no user interaction required. Exploitation details or in-the-wild status are n...

CVE-2023-21319

CVE-2023-21319 affects Android (UsageStatsService) and describes a side-channel information disclosure that could allow reading installed 3rd‑party apps. The root cause is local information disclosure without additional privileges or user interaction. The Android 14 Security Release Notes list th...

CVE-2023-21348

The CVE-2023-21348 entry concerns Android Window Manager side-channel leakage that allows an app to be detected as installed without query permissions, causing local information disclosure. Connected sources corroborate the issue as an information-disclosure vulnerability (Framework category) wit...

CVE-2023-21390

CVE-2023-21390 is described across multiple sources as a permission bypass in the Android environment related to a component labeled as Sim, allowing evasion of mobile-preference restrictions and enabling local privilege escalation without requiring extra execution privileges. Exploitation is rep...

CVE-2023-32883

CVE-2023-32883 affects MediaTek devices with Engineer Mode where a missing bounds check enables an out-of-bounds write, potentially allowing local escalation of privileges (System) without user interaction. Root cause: improper bounds checking in Engineer Mode. Impact: local privilege escalation ...

CVE-2023-48416

CVE-2023-48416 is a null dereference issue reported in multiple locations that can cause remote denial of service without user interaction. In the Pixel Security bulletin, this CVE is listed under Pixel components as a DoS vulnerability of Moderate severity affecting the Modem subcomponent. The u...

CVE-2024-20064

CVE-2024-20064 : MediaTek wlan service contains an out-of-bounds write caused by improper input validation, enabling local privilege escalation with no user interaction. Impact is described as high (C/H/I/A). Exploitation is local with low privileges required; UI interaction is not needed. Patch ...

CVE-2024-44101

CVE-2024-44101 is a DoS vulnerability affecting Google Pixel devices’ Modem, caused by a Null Pointer Dereference from improper input validation. Exploitation requires no user interaction and is modeled as network-accessible with high impact (remote DoS). Public details across sources confirm the...

CVE-2024-47012

CVE-2024-47012 affects Google Pixel devices via the mm_GetMobileIdIndexForNsUpdate path in mm_GmmPduCodec.c, where an incorrect bounds check can cause an out-of-bounds write. This is described as enabling local escalation of privilege with no extra execution privileges or user interaction require...

CVE-2024-53834

CVE-2024-53834 affects Google Android’s sms_Utilities.c, specifically the function sms_DisplayHexDumpOfPrivacyBuffer. The vulnerability is an out-of-bounds read caused by an incorrect bounds check, leading to remote information disclosure without extra privileges or user interaction. Public refer...

CVE-2025-0092

CVE-2025-0092 : A permission bypass exists in Android’s Bluetooth stack, specifically in handleBondStateChanged of AdapterService.java, caused by a misleading or insufficient UI. This can lead to information disclosure to a proximal attacker without additional execution privileges; exploitation r...

CVE-2025-22404

CVE-2025-22404 is a use-after-free vulnerability in Android's avct_lcb_act.cc (avct_lcb_msg_ind) that could allow local privilege escalation without user interaction or extra privileges. Affected component is within the Bluetooth-related code path; exploitation leads to arbitrary code execution l...

CVE-2025-22409

CVE-2025-22409 is a local Elevation of Privilege in Android-related code caused by a use-after-free in rfc_send_buf_uih within rfc_ts_frames.cc, enabling arbitrary code execution with no extra privileges and no user interaction. Connected sources confirm the vulnerability class and the affected f...

CVE-2025-22410

CVE-2025-22410 is a use-after-free in Google Android that can lead to arbitrary code execution and local privilege escalation with no user interaction. The issue is classified as RCE, Critical, affecting the Framework/System and is addressed by Android security patches for the 2025-03-01/2025-03-...

CVE-2025-48539

CVE-2025-48539: In SendPacketToPeer of acl_arbiter.cc there is a possible out-of-bounds read due to a use-after-free, which could enable remote code execution with no additional privileges and no user interaction. Connected documents identify this as an Android System component issue with high se...

CVE-2009-1754

The CVE-2009-1754 entry describes Android 1.5 (CRB42) allowing a package to share a UID without proper verification of developer certificates during installation. This enables a remote, user‑assisted attacker to access data from other apps by installing a package that uses a sharedUserId with arb...

CVE-2014-7951

The CVE-2014-7951 entry details a Directory traversal vulnerability in Android's adb (Android 4.0.4) where an attacker with physical access and a direct connection can write to arbitrary system-owned files by crafting tar headers with a .. sequence. Connected documents (including exploit examples...

CVE-2015-3837

CVE-2015-3837 affects Android’s OpenSSLX509Certificate class (org/conscrypt/OpenSSLX509Certificate.java) in builds prior to 5.1.1 LMY48I. The root cause is improper inclusion of certain context data during serialization and deserialization, enabling a malicious local application to trigger code e...

CVE-2016-1503

CVE-2016-1503 affects dhcpcd prior to version 6.10.0 (used in Android 4.x/5.x/6.x and other products). The issue is a mismanagement of DHCP option lengths in the print_option path, leading to a heap-based buffer overflow that can enable remote code execution or cause a denial of service via malfo...

CVE-2016-1948

Mozilla Firefox for Android before 44.0 is vulnerable to MITM during lightweight-theme installation because it may not require HTTPS for the client-server data stream, allowing an attacker to replace theme images/colors. Connected advisories indicate this is a real vulnerability affecting Firefox...

CVE-2017-0547

CVE-2017-0547 is an information-disclosure vulnerability in Android’s Mediaserver (libmedia). The issue allows a local malicious application to access data outside its permission levels due to a bypass in Mediaserver protections. Affected Android versions include 4.4.4–7.1.1 (as listed in the ini...

CVE-2017-0761

CVE-2017-0761 affects Android's media framework (libavc). It is a remote code execution vulnerability impacting Android 6.0/6.0.1, 7.0, 7.1.1, 7.1.2 and 8.0. The issue is documented in the Android Security Bulletin with patches released for the 2017-09-01/2017-09-05 patch levels; mitigation is to...

CVE-2017-0812

CVE-2017-0812 is an elevation-of-privilege vulnerability in Google's Android media framework (audio hal). Affected products: Android 7.0, 7.1.1, 7.1.2, and 8.0 (Android ID A-62873231). The issue is categorized as EoP in the Media framework component and is documented in the Android Security Bulle...

CVE-2017-10998

CVE-2017-10998 : In Qualcomm’s audio driver used on Android CAF builds, the function audio_aio_ion_lookup_vaddr uses a user-provided buffer length to validate the region. If length is large, the address+length check can overflow, yielding a result well below the valid region. This can lead to out...

CVE-2018-6267

CVE-2018-6267 affects NVIDIA’s Tegra OpenMax driver (libnvomx): a missing/incorrect validation of input can affect control or data flow, potentially enabling DoS or elevation of privilege. Public NVIDIA bulletins confirm this CVE is addressed as part of Jetson TX1/TX2 L4T updates; remediation inv...

CVE-2018-9386

CVE-2018-9386 concerns the HTC reboot_block driver. The reboot_block_command may trigger a stack buffer overflow due to a missing bounds check, enabling local privilege escalation to SYSTEM with no user interaction required. Connected sources (NVD, Red Hat, CVE lists) confirm the issue descriptio...

CVE-2018-9429

CVE-2018-9429 involves an out-of-bounds read due to uninitialized data in the function buildImageItemsIfPossible of ItemTable.cpp, leading to possible information disclosure without extra privileges. The vulnerability is linked to Google Pixel/Nexus security context (Pixel bulletin) with a public...

CVE-2019-2134

CVE-2019-2134 affects Android due to an out-of-bounds write in phFriNfc_ExtnsTransceive (phNxpExtns_MifareStd.cpp) caused by integer overflow. Impact: local privilege escalation with HIGH confidentiality/integrity/availability implications; exploitation requires user interaction and local access....

CVE-2021-0542

CVE-2021-0542 affects Android 11, with the issue residing in the BeamTransferManager.java workflow where a missing permission check in updateNotification can lead to local information disclosure of paired Bluetooth addresses. Exploitation requires no additional execution privileges but may requir...

CVE-2021-0558

CVE-2021-0558 is a vulnerability in the Android 11 Media Framework where fillMainDataBuf in pvmp3_framedecoder.cpp can trigger an out-of-bounds read due to a heap buffer overflow. This could allow remote information disclosure and, per the available data, would require user interaction for exploi...

CVE-2021-0734

CVE-2021-0734 describes a side-channel information disclosure in Android Settings that can reveal whether an app is installed without query permissions, enabling local information disclosure on Android 13. The issue affects the Settings component and does not require user interaction, with a loca...

CVE-2021-0978

CVE-2021-0978 affects Android 12 and concerns the getSerialForPackage path in DeviceIdentifiersPolicyService.java. The vulnerability arises from a side-channel information disclosure that lets an attacker determine whether an app is installed without using query permissions. This enables local in...

CVE-2021-0991

CVE-2021-0991 affects Android 12 via the OnMetadataChangedListener in AdvancedBluetoothDetailsHeaderController.java, causing a log information disclosure that could leak Bluetooth MAC addresses. The root cause is information disclosure through verbose/loggable data, enabling local information dis...

CVE-2021-1042

CVE-2021-1042 affects the Android kernel component dsi_panel.c (function dsi_panel_debugfs_read_cmdset). It describes a use-after-free that can disclose freed kernel heap memory, enabling local information disclosure with system privileges (no user interaction required). Connected sources (NVD, R...

CVE-2021-39645

CVE-2021-39645 is listed in the Google Pixel security bulletin as an Elevation of Privilege (EoP) vulnerability affecting the Bootloader. The CVE is categorized under Pixel issues with High severity. The Pixel bulletin notes patches are included in updates at the 2021-12-05 security patch level f...

CVE-2021-39649

CVE-2021-39649 affects the Android kernel’s regmap.c, specifically regmap_exit, where improper locking can cause a use-after-free. This enables local escalation of privilege with system execution privileges required and no user interaction. Exploitation status is not provided in the sources; reme...

CVE-2021-39683

CVE-2021-39683 targets Android kernel code, specifically in copy_from_mbox within sss_ice_util.c, where a missing bounds check can trigger an out-of-bounds write. This leads to local elevation of privilege with System execution privileges required, and does not require user interaction. The issue...

CVE-2021-39784

The CVE-2021-39784 issue is reported for Android 12L and involves the CellBroadcastReceiver. The root cause is a missing permission check, enabling a path to turn on specific cellular features, which can lead to local elevation of privilege without extra execution privileges and without user inte...

CVE-2022-20038

CVE-2022-20038 affects the ccu driver in MediaTek hardware. The issue is memory corruption caused by an incorrect bounds check, enabling local escalation of privilege with System execution privileges required. Exploitation does not require user interaction. Reported impact is consistent across so...

CVE-2022-20093

CVE-2022-20093 concerns a vulnerability in telephony on MediaTek chips. The issue is a missing permission check that could allow a local attacker to disable receiving SMS messages, enabling local privilege escalation without extra privileges. Affected products include a broad set of MediaTek MT-s...

CVE-2022-20252

CVE-2022-20252 is a vulnerability in Android 13’s PackageManager where an attacker can deduce whether an app is installed without query permissions due to a side-channel information disclosure. This enables local information disclosure with no extra execution privileges required; exploitation req...

CVE-2022-20316

This CVE-2022-20316 affects Android 13 ContentResolver. The vulnerability involves a side-channel information disclosure that can reveal whether an app is installed without query permissions, enabling local information disclosure with no additional execution privileges required. The issue is docu...

CVE-2022-21786

CVE-2022-21786 describes a memory corruption vulnerability in MediaTek’s audio DSP caused by improper type casting. The issue can lead to local privilege escalation with system execution privileges required, and does not require user interaction. Affected component: audio DSP type conversion logi...

CVE-2022-26097

CVE-2022-26097 affects the libsimba library, specifically the parser_unknown_property function, where a null pointer dereference can lead to an out-of-bounds write. The issue is exploitable remotely over a network with no authentication and no user interaction, and is reported to impact confident...

CVE-2022-26430

CVE-2022-26430 affects MediaTek devices with a mailbox type confusion leading to out-of-bounds write. This can enable local privilege escalation to SYSTEM level with no user interaction required. Patch ALPS07032521 (Issue ALPS07032521) referenced in multiple sources; no remediation details beyond...

CVE-2022-26465

CVE-2022-26465 relates to MediaTek audio IPI, where an incorrect bounds check can trigger an out-of-bounds write in the audio IPI component. The vulnerability could enable local escalation of privilege with SYSTEM execution privileges, and does not require user interaction for exploitation. A pat...

CVE-2022-28782

CVE-2022-28782 concerns Samsung’s Contents To Window in the context of the SMR May-2022 Release 1. The issue is described as an improper access control that could allow a physical attacker to install a package before the Setup wizard finishes. The available remediation is a patch that blocks the ...