CVE-2022-21761

CVE-2022-21761 affects the apusys driver, where an integer overflow can trigger a system crash. This could lead to local denial of service with SYSTEM privileges required and no user interaction. The reported remediation is patch ALPS06479532 (Issue ALPS06479532). The connected sources confirm th...

CVE-2018-9400

The CVE-2018-9400 issue affects Mediatek GT1151 touchscreen drivers (GT1151/gt1x_generic.c and gt1x_tools.c). Root cause: missing bounds check enabling an out-of-bounds write in gt1x_debug_write_proc and gt1x_tool_write. Impact: local escalation of privilege with System execution privileges requi...

CVE-2018-9404

The CVE-2018-9404 issue affects Google Pixel/Nexus devices and is centered on the oemCallback function in ril.cpp, where an out-of-bounds write can result from an integer overflow. This could enable local elevation of privilege with System execution privileges required, and exploitation does not ...

CVE-2018-9462

CVE-2018-9462 describes an out-of-bounds write in the Android kernel component ftm4_pdc.c, within the store_cmd function, caused by an incorrect bounds check. This can enable local escalation of privilege to system execution privileges, with no user interaction required. The description specifies...

CVE-2018-9527

The CVE-2018-9527 issue affects Android’s Media framework, specifically in vorbis_book_decodev_set of codebook.c, where a missing bounds check can cause an out-of-bounds write. This could enable remote code execution with no extra privileges, requiring user interaction to exploit. Affected versio...

CVE-2018-9549

CVE-2018-9549 is a concrete Android vulnerability in the Media Framework (lppTransposer function in lpp_tran.cpp) caused by a missing bounds check that enables a remote code execution via a crafted file. It affects Android versions 7.0 (Nougat) through 9 (Pie). The Android bulletin identifies it ...

CVE-2018-9586

The CVE-2018-9586 issue affects Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1 and 9.0. It stems from a race condition in InstallPackageTask.java that can leave package verification turned off, enabling local elevation of privilege with no extra execution privileges or user interaction required. Affected pr...

CVE-2019-2050

CVE-2019-2050 affects Android 8.0–9 due to a use-after-free in tearDownClientInterface() within WificondControl.java caused by improper locking. This enables local elevation of privilege with no additional execution privileges and no user interaction required. Public docs indicate a platform-wide...

CVE-2019-2063

CVE-2019-2063 affects Android 10 via libxaac where an out-of-bounds write is caused by a missing bounds check. The issue can lead to remote code execution in the media server, requiring user interaction to exploit. The CVE is documented by NVD with a high-severity vector (CVSS 3.1: AV:N/AC:L/PR:N...

CVE-2019-2067

CVE-2019-2067 affects libxaac in Android 10, where a missing bounds check allows an out-of-bounds write leading to remote code execution. Exploitation is network-scoped with user interaction required for exploitation (per CVE details). Root cause: bounds-check omission in libxaac. Affected produc...

CVE-2019-2144

CVE-2019-2144 affects libxaac in Android 10, where a missing bounds check can cause an out-of-bounds read leading to information disclosure. The vulnerability does not grant privileges and requires user interaction to exploit. Exploitation details are not provided in the supplied documents. The i...

CVE-2019-9250

CVE-2019-9250 affects Android 10 Bluetooth, describing an out-of-bounds read due to a missing bounds check that can lead to remote information disclosure. Impact is high (per CVSS 3.1: HIGH, confidentiality impact HIGH) with no user interaction required. Exploitation status is not detailed in the...

CVE-2019-9283

CVE-2019-9283 affects the Android 10 AAC Codec, where a vulnerability in input validation can cause resource exhaustion leading to a remote Denial of Service. The impact is DoS with high availability impact, and exploitation requires user interaction. The root cause is improper input validation w...

CVE-2019-9304

CVE-2019-9304 affects the Android 10 Media Framework, specifically the libMpegTPDec component. The issue is a possible out-of-bounds write caused by an integer overflow in a decoding path, which could enable remote code execution. Exploitation requires user interaction, and the risk is tied to th...

CVE-2019-9356

CVE-2019-9356 affects Android 10 NFC server and is caused by a missing bounds check that enables an out-of-bounds read. This can lead to local information disclosure with no additional execution privileges required, and user interaction is needed for exploitation. The issue is documented in Andro...

CVE-2019-9372

In CVE-2019-9372, the issue is in libskia on Android 10 where a missing null check can cause a crash, resulting in remote denial of service. The CVSS metrics indicate NETWORK attack vector, low attack complexity, no privileges required, and user interaction required, with an availability impact o...

CVE-2019-9430

CVE-2019-9430 is a Bluetooth vulnerability affecting Android 10 where a null pointer dereference due to a missing null check could enable remote DoS without user interaction. The issue is described as a Bluetooth component failure in Android 10, with the root cause categorized as a null pointer d...

CVE-2020-0004

CVE-2020-0004 affects Android 8.0–10 in WallpaperManagerService.generateCrop, where processing an image that exceeds the maximum texture size can trigger a local DoS in the systemui. The root cause is an image-texture handling issue in WallpaperManagerService.java. The vulnerability is local and ...

CVE-2020-0006

CVE-2020-0006 affects Android 8.0–10, with a heap information-disclosure in rw_i93_send_cmd_write_single_block (rw_i93.cc). The underlying issue is uninitialized data leading to remote information disclosure in the NFC server; exploitation requires user interaction. Impact per the sources is info...

CVE-2020-0049

CVE-2020-0049 affects Android 10 Media Framework (StreamingSource.cpp: onReadBuffer()) with an information disclosure due to uninitialized data. Impact: potential remote information disclosure; exploitation requires user interaction. The issue is listed under Pixel security bulletins for CVE-2020...

CVE-2020-11875

CVE-2020-11875 affects LG mobile devices running Android 8.0–10.0 with MTK chipsets. The MTK kernel is reported to mishandle exceptions, enabling local privilege escalation for an attacker (privileges gained via local access). Documents show a high-severity impact (NVD CVSS v3.1: 7.8, HIGH; v2: 7...

CVE-2020-28342

Technical details are not publicly available in the provided documents; no information on affected products, components, or fixes beyond the generic description. Monitor for updates.

CVE-2021-0526

CVE-2021-0526 concerns the Android memory management driver (MediaTek) with an out-of-bounds write caused by uninitialized data. The issue enables local escalation of privilege without extra execution privileges, and does not require user interaction. Multiple sources (NVD, Red Hat, CVE records, ...

CVE-2021-0975

CVE-2021-0975 affects Android 13 with a side-channel in USB Manager that can reveal whether an app is installed without query permissions. This enables local information disclosure of installed packages with no extra execution privileges and no user interaction required. Exploitation status is no...

CVE-2021-1014

CVE-2021-1014 affects Android 12 via the getNetworkTypeForSubscriber path in PhoneInterfaceManager.java. The vulnerability arises from a side-channel that lets a local attacker determine whether an app is installed without query permissions, enabling local information disclosure without additiona...

CVE-2021-1019

CVE-2021-1019 affects Android 12 where in snoozeNotification() of NotificationListenerService.java a permission confusion arises from a misleading user consent dialog. This enables local elevation of privilege with user interaction required for exploitation. The NVD notes a base CVSSv3.1 score of...

CVE-2021-38591

CVE-2021-38591 affects LG mobile devices running Android P/Q on mt6762/mt6765/mt6883. Root cause: misconfiguration of a debug command that allows attackers to modify NvRAM content. Documented impact is limited to NvRAM manipulation; no exploit details or in‑the‑wild data are provided. No remediat...

CVE-2022-20282

CVE-2022-20282 affects Android 13: AppWidget can start an activity from the background due to a missing permission check, enabling local privilege escalation without extra execution privileges. Impact: local compromise with high confidentiality, integrity, and availability implications per CVSSv3...

CVE-2022-20296

This CVE affects Android 13 ContentService. The issue is a missing permission check that allows an attacker with local access to determine whether an account exists on the device, enabling local information disclosure. Exploitation is rated as LOCAL with LOW exploit complexity and requires LOW pr...

CVE-2022-20311

CVE-2022-20311 affects Android 13 Telecomm: a missing permission check could disclose registered self-managed phone accounts, enabling local information disclosure with low risk of exploitation (attack vector LOCAL, UI:N). Root cause is a permission check omission in Telecomm that exposes sensiti...

CVE-2022-20326

CVE-2022-20326 affects Android 13 Telephony: a missing permission check allows disclosure of SIM identifiers via local information disclosure with low privileges and no user interaction. The issue is categorized as Information Disclosure/Telephony, with impact limited to confidential data exposur...

CVE-2022-20331

CVE-2022-20331 affects the Android 13 Framework. A tapjacking/overlay flaw can enable a work profile without user consent, causing local escalation of privilege. Exploitation requires user interaction but does not need extra execution privileges. CVSS v3.1 base score is High (7.8) with LOCAL atta...

CVE-2022-20339

CVE-2022-20339 affects Android 13 and is caused by an insecure SEpolicy configuration that allows access to the network neighbor table, leading to local information disclosure of network topography with no additional execution privileges and no user interaction required. The incident is described...

CVE-2022-20341

CVE-2022-20341 affects Android 13’s ConnectivityService, where a missing permission check enables a local bypass of network permissions. This could allow an information disclosure of tethering interfaces with no additional execution privileges required, and does not require user interaction. Expl...

CVE-2022-26427

CVE-2022-26427: In camera isp, there is an out-of-bounds write due to a missing bounds check that can lead to local privilege escalation with System execution privileges required. No user interaction is needed. Patch ALPS07085540 / Issue ALPS07085540. Public references point to MediaTek/ALPS advi...

CVE-2022-32593

The CVE-2022-32593 entry concerns MediaTek’s vowe component, where a missing bounds check can cause an out-of-bounds write. This vulnerability enables local escalation of privileges with System execution privileges required, and does not require user interaction. The issue is tied to the vowe cod...

CVE-2022-32603

CVE-2022-32603 concerns MediaTek GPU DRM with an out-of-bounds write caused by improper input validation, enabling local privilege escalation with System execution privileges required. User interaction is not needed. A patch (ALPS07310704, Issue ID ALPS07310704) exists; details on affected versio...

CVE-2022-32649

CVE-2022-32649 describes a local use-after-free in the jpeg component caused by a logic error, enabling local privilege escalation to SYSTEM with no user interaction. Affected software is described only as jpeg (no vendor/product version details provided in the documents). The vulnerability’s imp...

CVE-2022-33687

Exposure of Sensitive Information in telephony-common.jar prior to the Samsung SMR July‑2022 Release 1 allows a local attacker with log access to obtain IMSI from device logs. The issue stems from information disclosure in telephony-common.jar on Samsung mobile devices. Affected component: teleph...

CVE-2022-36847

CVE-2022-36847 describes a use-after-free in the MTP driver’s mtp_send_signal function on Samsung Mobile devices, prior to the SMR Sep-2022 Release 1. The vulnerability could enable attackers to perform malicious actions locally; affected component is the MTP driver, with impact described as high...

CVE-2022-38683

CVE-2022-38683 affects the contacts service, where a missing permission check could allow local denial of service without additional execution privileges. Public documents consistently describe a local, privilege-check issue in the contacts service as the root cause. The CVSS vector indicates LOC...

CVE-2022-47323

CVE-2022-47323 affects the WLAN driver due to missing parameter checks, enabling local denial of service in WLAN services. The issue is documented with local-attack vector and impact on availability (NVD CVSS 3.1 base 5.5; CNA CVSS 3.1 base 6.4), stemming from insufficient input validation in the...

CVE-2023-20736

CVE-2023-20736 affects the vcu component. The vulnerability is an out-of-bounds write caused by a race condition, enabling local escalation of privilege with System execution privileges required and no user interaction. A patch is referenced: ALPS07645149 (Issue ALPS07645189). Exploitation detail...

CVE-2023-20745

The CVE-2023-20745 entry relates to the vcu module in MediaTek chips, where an out-of-bounds write can occur due to improper locking. This could enable local escalation of privilege to SYSTEM with no user interaction required. Available references consistently describe the issue as a local-privil...

CVE-2023-21159

CVE-2023-21159 affects the Android kernel component, specifically a missing bounds check in the Parse function of simdata.cpp, causing an out-of-bounds write that could enable local escalation of privilege with System-level execution rights and no user interaction required. In available connected...

CVE-2023-21172

CVE-2023-21172 affects Android 13 where the WifiCallingSettings.java functions allow changing calling preferences for the admin user due to a permissions bypass. This enables local elevation of privilege with no extra execution privileges needed and requires no user interaction to exploit. No spe...

CVE-2023-32828

The CVE-2023-32828 issue affects the vpu component and is described as an integer overflow causing an out-of-bounds write. This could enable local escalation of privilege with System-level execution privileges required; no user interaction is needed. Reported patch ID: ALPS07767817 (Issue ALPS077...

CVE-2023-32829

CVE-2023-32829 affects the apusys component: a possible out-of-bounds write caused by an integer overflow. This can lead to local escalation of privilege with System execution privileges required, and no user interaction is needed for exploitation. A patch is available: ALPS07713478 (Issue ALPS07...

CVE-2023-33906

CVE-2023-33906 concerns a missing permission check in the Contacts Service, leading to potential local information disclosure without requiring additional execution privileges. Public sources consistently describe the issue as a permission check omission, yielding information exposure at the loca...

CVE-2025-20651

CVE-2025-20651 describes a potential out-of-bounds read caused by a missing bounds check in the affected component (described only as part of an unspecified implementation) that could lead to local information disclosure. Exploitation requires physical access to the device and user interaction; t...