CVE-2020-28345

CVE-2020-28345 affects LG mobile devices running Android 10. The issue is in the Wi‑Fi subsystem, where a missing NULL parameter check can cause a crash. This is described in multiple sources (e.g., NVD/Red Hat entries) with no public details on a fix in the provided documents. Impact is indicate...

CVE-2021-0996

CVE-2021-0996 affects Android 12 where the out-of-bounds read occurs in nfaHciCallback within HciEventManager.cpp due to a missing bounds check. This leads to local information disclosure over NFC with System privileges required for exploitation, and does not require user interaction. Connected s...

CVE-2021-1007

CVE-2021-1007 corresponds to an Android 12 vulnerability in the Bluetooth host stack: in btu_hcif_process_event (btu_hcif.cc) there is an out-of-bounds read caused by an incorrect bounds check. The impact is local information disclosure with the potential for system-level privileges, with no user...

CVE-2021-25338

CVE-2021-25338 describes an improper memory access control weakness in the RKP of Samsung mobile devices prior to the SMR Mar-2021 Release 1. The issue allows a compromised kernel to write portions of the RKP EL2 memory region, implying local attacker capabilities with kernel-level access and pot...

CVE-2021-25358

CVE-2021-25358 affects Samsung SMR (system patch package). Before SMR APR-2021 Release 1, IMSI values could be stored in an improper path, enabling local attackers to access IMSI values via untrusted applications. Vulnerability is localized to affected SMR components; root cause is improper stora...

CVE-2021-25444

CVE-2021-25444 is a vulnerability in Samsung’s Keymaster Trusted Application (TA) running in the ARM TrustZone Secure World. The issue is an IV reuse flaw in the Keymaster TA that decrypts custom key blobs, enabling a privileged process to access hardware-backed keys. Affected devices include Sam...

CVE-2022-20255

The CVE-2022-20255 issue affects Android 13 (SettingsProvider). A missing permission check could allow a local attacker to read or modify the default ringtone, enabling local elevation of privilege without extra execution privileges and without requiring user interaction. The vulnerability is doc...

CVE-2022-20278

CVE-2022-20278 affects Android 13, in Accounts, due to insufficient log filtering that could write sensitive data to the system log. This enables local information disclosure with system privileges, no user interaction required. The issue is addressed in Android 13 security fixes; devices with pa...

CVE-2022-20285

CVE-2022-20285 affects Android 13 and involves a side-channel in PackageManager that can reveal whether an app is installed without query permissions, enabling local information disclosure with no user interaction. Affected component: PackageManager/framework behavior in Android 13; root cause is...

CVE-2022-20292

In Android 13 Settings, CVE-2022-20292 is described as a logic error that could bypass factory reset protections, enabling local escalation of privileges without additional privileges and with no user interaction required. Affected product: Android 13; vulnerable area: Settings. The issue is repo...

CVE-2022-20297

In Android 13, CVE-2022-20297 affects the Settings component, where a logic error could bypass factory reset protections. This enables local escalation of privilege without additional execution privileges and requires no user interaction. The vulnerability is described across multiple sources as ...

CVE-2022-20319

CVE-2022-20319 affects Android 13 via DreamServices, where a confused deputy could launch arbitrary protected activities, causing local escalation of privilege. Exploitation is described as local (attack vector: LOCAL) with low privileges required and no user interaction needed, potentially eleva...

CVE-2022-20327

The CVE-2022-20327 entry concerns Android 13 where there is a vulnerability allowing retrieval of the WiFi SSID without location permissions due to a missing permission check. This enables local information disclosure with user execution privileges, and exploitation requires user interaction. The...

CVE-2022-20335

CVE-2022-20335 (Android 13) affects the Wifi Slice component where a missing permission check allows an attacker to adjust Wi‑Fi settings, enabling local escalation of privilege with no user interaction required. Root cause: insufficient permission validation in the Wifi Slice flow. Impact: local...

CVE-2022-27823

CVE-2022-27823 affects Samsung SMR libsapeextractor: the sapefd_parse_meta_HEADER_old function may read out of bounds when processing a crafted media file. The issue is rooted in an improper size check, enabling out-of-bounds reads. Impact is described as partial confidentiality and partial avail...

CVE-2022-28780

CVE-2022-28780 concerns an improper access control in the Weather feature prior to Samsung SMR May-2022 Release 1, enabling unauthorized access to location information set in Weather. The issue is mitigated by a patch that adds proper protection to prevent access to location data. Connected docum...

CVE-2022-33702

CVE-2022-33702 affects Samsung Knoxguard; an improper authorization flaw allows a local attacker to disable the keyguard and bypass the Knoxguard lock via a factory reset on Knoxguard versions prior to SMR Jul-2022 Release 1. The issue is documented across multiple sources (NVD, Red Hat, CNVD, PR...

CVE-2022-33722

Affected product: Samsung Smart View (prior to SMR Aug-2022 Release 1). Vulnerability: Implicit Intent hijacking that allows an attacker to access the MAC address of a connected device. Root cause / nature: Vulnerability in Smart View’s handling of implicit intents (modeled as an intent hijack). ...

CVE-2022-36862

CVE-2022-36862 is a heap-based overflow in HWR::EngineCJK::Impl::Construct() within libSDKRecognitionText.spensdk.samsung.so, affecting Samsung mobile/S pen SDK components prior to the SMR Sep-2022 Release 1. The root cause is a heap overflow that can cause a memory access fault. Public exploitat...

CVE-2022-38680

In CVE-2022-38680, the vulnerability is in the WLAN driver where a missing parameter check can allow local denial of service against WLAN services. Affected component: WLAN driver (details on exact versions not provided). Root cause: insufficient validation of parameters leading to resource disru...

CVE-2022-39847

The CVE-2022-39847 entry concerns a use-after-free vulnerability in the NFC driver’s set_nft_pid and signal_handler functions on Samsung devices prior to the SMR Oct‑2022 Release 1. Affected component: NFC driver (Samsung Mobile). Root cause: use-after-free in specific NFC driver handlers, enabli...

CVE-2022-39884

CVE-2022-39884 is an improper access control issue in IImsService prior to Samsung SMR Nov-2022 Release 1 that could allow a local attacker to access Call information. Documented impact is local and requires low attack complexity with local access; no public exploit details are provided in the co...

CVE-2022-42765

CVE-2022-42765 concerns a missing bounds check in the wlan driver, leading to local denial of service in wlan services. The Red Hat/NVD descriptions and related feeds consistently cite a bound-check omission in the wlan driver as the root cause, with local attacker context and impact on availabil...

CVE-2022-44439

CVE-2022-44439: Connected sources describe a missing permission check in the messaging service that could permit a local denial of service affecting the contacts service without requiring additional execution privileges. The vulnerability is evaluated with CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:...

CVE-2022-44444

The CVE-2022-44444 entry concerns a vulnerability in the WLAN driver caused by a missing bounds check. Affects the WLAN driver component and could lead to local denial of service in WLAN services. Exploitation details, affected versions, and a confirmed patch/remediation are not disclosed in the ...

CVE-2022-44447

The CVE-2022-44447 vulnerability affects the wlan driver (reported across multiple feeds) due to a missing bounds check that can cause a NULL pointer dereference, leading to local denial of service in wlan services. The issue is characterized by local attack vector, low complexity, and no user in...

CVE-2022-44448

CVE-2022-44448 affects the WLAN driver, where a missing parameter check in the wlan driver can lead to local denial of service in WLAN services. Multiple documents confirm the issue description across NVD, Red Hat, CVE listings, and related feeds. Root cause: insufficient parameter validation in ...

CVE-2022-47342

CVE-2022-47342: Affected via engineermode services on Unisoc chipsets; root cause is a missing permission check that allows local access to sensitive engineermode functionality, causing local denial of service. Impact is indicated as High for availability with local attack vector and low privileg...

CVE-2022-47471

CVE-2022-47471: A missing permission check in the telephony service can lead to local information disclosure without extra privileges. The core issue is in the telephony module; evidence across sources (NVD/Red Hat/ CVE listings) describes a LOCAL attack with high confidentiality impact (C:H, I:N...

CVE-2022-48247

CVE-2022-48247 targets UNISOC audio service with a missing permission check, enabling local escalation of privilege. Root cause: insufficient permission validation in the audio service leading to unauthorized access. Affected: audio service on UNISOC chipsets; attack vector LOCAL, complexity LOW,...

CVE-2023-20661

CVE-2023-20661 affects the wlan component (MediaTek-related stack) and is caused by an out-of-bounds write resulting from an integer overflow. The vulnerability can lead to local privilege escalation with System execution privileges required and does not require user interaction. Reported impact ...

CVE-2023-20704

The CVE-2023-20704 involves the apu component in MediaTek chips, where a missing bounds check can trigger an out-of-bounds read and local information disclosure without requiring user interaction. Affected element: apu on MediaTek hardware. Root cause: bounds-check omission leading to memory read...

CVE-2023-20731

CVE-2023-20731 affects the MediaTek WLAN component. The root cause is a missing bounds check that enables an out-of-bounds read, leading to local information disclosure with System execution privileges required. User interaction is not needed. Patch ID ALPS07573495 (Issue ALPS07573495) is listed ...

CVE-2023-20796

The CVE-2023-20796 vulnerability affects MediaTek devices in the power module. It is a memory corruption issue caused by an incorrect bounds check, leading to local denial of service with system execution privileges required; no user interaction is needed. A patch is available (ALPS07929790). Exp...

CVE-2023-21326

Summary of CVE-2023-21326 : This Android vulnerability affects the Package Manager Service and allows a local attacker to determine whether an app is installed without query permissions, via a side-channel information disclosure. The impact is information disclosure (confidentiality) with no user...

CVE-2023-21362

CVE-2023-21362 affects Google Android (Android Framework). The issue is a DoS caused by resource exhaustion that can lead to local denial of service without extra privileges. The available documents cite it as a Framework DoS in Android 14 release notes, with no exploitation details provided. Mit...

CVE-2023-40637

CVE-2023-40637 involves UNISOC chipsets’ telecom service where a missing permission check could allow local information disclosure without executing code or elevating privileges. The NVD entry notes a local attack vector with low adversarial effort and low privileges required, exposing high-confi...

CVE-2023-40644

CVE-2023-40644 affects the Messaging component in UNISOC chipsets, due to a missing permission check that could allow local information disclosure without extra execution privileges. The issue is described with a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Connected sources...

CVE-2023-42639

CVE-2023-42639 affects the validationtools component. The issue is a missing permission check that can allow local information disclosure without requiring additional privileges. The available sources (NVD, Red Hat, PRION, etc.) describe the vulnerability as a local-disclosure flaw and do not pro...

CVE-2023-42644

CVE-2023-42644 affects the dm service, where a possible missing permission check could permit local information disclosure without requiring additional execution privileges. Connected sources consistently describe a local-privilege-check omission as the root cause. Consequences are limited to inf...

CVE-2023-52347

The collected details indicate a vulnerability in the ril service where a missing bounds check can cause an out-of-bounds write, leading to local denial of service with System execution privileges. Affected software: ril service (UNISOC/Unisoc-derived platforms referenced in multiple reports). Ro...

CVE-2023-52352

Summary: CVE-2023-52352 concerns the Network Adapter Service where a missing permission check could allow local denial of service without extra execution privileges. The connected documents link this vulnerability to UNISOC chipsets and multiple trackers (Red Hat, NVD, CVE list, PT Security, CNNV...

CVE-2024-20002

CVE-2024-20002 affects TVAPI with an out-of-bounds write caused by a missing bounds check. The vulnerability allows local escalation to SYSTEM with no user interaction required, as indicated by both NVD and Red Hat entries. The impact is limited to local privilege escalation with high confidentia...

CVE-2024-39435

CVE-2024-39435 affects the Logmanager service. The root cause is a missing verification/input validation in the service, enabling local escalation of privilege without additional execution privileges. The available sources do not specify affected products/vendors beyond the Logmanager service, no...

CVE-2026-0073

CVE-2026-0073 affects Android devices via adbd_tls_verify_cert in auth.cpp, where a logic error could bypass wireless ADB mutual authentication. This could allow remote code execution as the shell user with no extra privileges, requiring no user interaction. Mitigation is to apply the 2026-05-01 ...

CVE-2026-0076

CVE-2026-0076 describes an out-of-bounds read in validateNode of ResourceTypes.cpp, caused by an incorrect bounds check. This could enable local privilege escalation with no user interaction, per the included descriptions. Connected sources repeat this detail across multiple feeds (NVD/EUVD) with...

CVE-2026-0078

CVE-2026-0078 affects Android’s DevicePolicyManagerService (setGlobalProxy). The issue is a desync in persistence caused by improper input validation, enabling local privilege escalation with no extra execution privileges required. Exploitation is described as local and does not require user inte...

CVE-2014-7921

CVE-2014-7921 affects Android mediaserver (Android 4.0.3 through 5.x prior to 5.1). The vulnerability is a privilege-escalation flaw enabled by mediaserver, per the CVE entry. Connected sources corroborate the same affected component and version range. The initial description does not provide roo...

CVE-2014-9795

CVE-2014-9795 affects the Android/Qualcomm stack on Nexus 5: the aboot.c implementation in Qualcomm components fails to properly guard against an integer overflow when processing crafted start/size values, enabling a local attacker to bypass access restrictions. The issue is tied to Android inter...

CVE-2016-10281

CVE-2016-10281 is an elevation-of-privilege vulnerability in the MediaTek thermal driver on Android that could allow a local malicious application to execute code in the kernel context. The issue is exploitable locally and requires a privileged process to be compromised first; no exploit details ...