CVE-2026-0078

CVE-2026-0078 affects Android’s DevicePolicyManagerService (setGlobalProxy). The issue is a desync in persistence caused by improper input validation, enabling local privilege escalation with no extra execution privileges required. Exploitation is described as local and does not require user inte...

CVE-2014-7921

CVE-2014-7921 affects Android mediaserver (Android 4.0.3 through 5.x prior to 5.1). The vulnerability is a privilege-escalation flaw enabled by mediaserver, per the CVE entry. Connected sources corroborate the same affected component and version range. The initial description does not provide roo...

CVE-2014-9795

CVE-2014-9795 affects the Android/Qualcomm stack on Nexus 5: the aboot.c implementation in Qualcomm components fails to properly guard against an integer overflow when processing crafted start/size values, enabling a local attacker to bypass access restrictions. The issue is tied to Android inter...

CVE-2016-10281

CVE-2016-10281 is an elevation-of-privilege vulnerability in the MediaTek thermal driver on Android that could allow a local malicious application to execute code in the kernel context. The issue is exploitable locally and requires a privileged process to be compromised first; no exploit details ...

CVE-2016-10385

CVE-2016-10385 is a high-severity use-after-free in IMS RCS across Qualcomm Android CAF builds using the Linux kernel. Public docs note a remote-exploitable condition with critical impact ( CVSSv3 9.8 ). The vulnerability affects Qualcomm firmware in CAF Android releases; Android security bulleti...

CVE-2016-2475

CVE-2016-2475 refers to an input validation vulnerability in the Broadcom Wi‑Fi driver that, on Android devices, could enable a local attacker to gain privileges for certain system calls via a crafted application. The issue affects Nexus devices (Nexus 5, 6, 6P, 7 (2013), 9, Nexus Player, Pixel C...

CVE-2016-3815

CVE-2016-3815 concerns the NVIDIA camera driver in Android (notably on Nexus 9). The connected NVIDIA bulletin entry specifies a kernel camera driver issue described as a stack read of a user-controlled length, which can disclose sensitive information to a crafted app. The associated details plac...

CVE-2016-6733

The CVE-2016-6733 entry describes an elevation-of-privilege vulnerability in the NVIDIA GPU driver for Android prior to 2016-11-05 that could allow a local malicious app to execute code in the kernel context. The impact is described as Critical, including potential permanent device compromise req...

CVE-2016-6735

CVE-2016-6735 describes an elevation-of-privilege in the NVIDIA GPU driver on Android devices prior to 2016-11-05 that could allow a local malicious app to execute arbitrary code in the kernel context. The initial entry and multiple connected sources confirm the issue as a local privilege escalat...

CVE-2017-0391

CVE-2017-0391 is a DoS vulnerability in Mediaserver’s libhevc decoder (decoder/ihevcd_decode.c). A remote attacker could exploit a specially crafted Media file to trigger a device hang or reboot. The Android bulletin/summary specifies this issue under the Media/Mediaserver entry with a High impac...

CVE-2017-0407

CVE-2017-0407 describes a remote code execution vulnerability in Android’s Mediaserver affecting the libhevc library. The issue can be triggered by processing a specially crafted media file, leading to memory corruption within the Mediaserver process. Affected products/versions are Android 6.0–7....

CVE-2017-0597

CVE-2017-0597 (Audioserver elevation of privilege) affects Android where a local malicious app could execute code in the context of a privileged process via the Audioserver. Affected products/versions include Android 4.4.4 through 7.1.2. The root cause is a privilege-escalation vulnerability with...

CVE-2017-0603

CVE-2017-0603 describes a denial-of-service in libstagefright within Mediaserver on Android. A crafted media file could cause a device hang or reboot. Affected versions: Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Root cause: DoS condition in Mediaserver/libstagefright. Impact: Mo...

CVE-2017-0691

CVE-2017-0691 is a denial-of-service vulnerability in the Android media framework affecting Android 7.0, 7.1.1 and 7.1.2 (Android ID A-36724453). The NVD CVSS data lists a medium severity (CVSSv2: 4.3; AV:N/AC:M/Au:N/I:N/C:N/A:P) and a CVSSv3 score of 5.5 (LOCAL, UI required, high availability im...

CVE-2017-0804

CVE-2017-0804 is an Elevation of Privilege vulnerability in the MediaTek MMC driver within the Android kernel. It affects the MMC driver component and is documented as a local privilege escalation (attack vector local, low attack complexity) with a high impact on confidentiality, integrity, and a...

CVE-2017-0814

CVE-2017-0814 is an information-disclosure vulnerability in the Android media framework. The Pixel/Nexus bulletin lists this CVE under the Media framework component with a mitigation path via security patches at the 2017-10-05 patch level, addressing devices updated to Android 7.0, 7.1.1, 7.1.2, ...

CVE-2017-0815

CVE-2017-0815 is a information-disclosure issue in Android’s media framework (libeffects) affecting Android 4.4.4 through 8.0. The root cause is an information disclosure vulnerability in the media framework; impact is partial confidentiality, with no indicated exploitation details in the provide...

CVE-2017-0819

The CVE-2017-0819 entry concerns a DoS vulnerability in Android’s media framework. The connected Pixel/Nexus security bulletin entry IPTV (Android security bulletin) lists CVE-2017-0819 under the Media framework with type NSI/DoS and indicates affected Android versions 7.0, 7.1.1, 7.1.2, and 8.0,...

CVE-2017-13272

CVE-2017-13272 affects Android (7.0–8.1). The issue is an out-of-bounds write caused by a use-after-free in alarm_ready_generic (alarm.cc), enabling remote escalation of privilege with no user interaction. CVSSv3 base score 9.8 (Network, High impact on confidentiality, integrity, availability). T...

CVE-2017-13317

CVE-2017-13317 involves a possible out-of-bounds read in HeifDecoderImpl::getScanline (HeifDecoderImpl.cpp) due to improper input validation. The issue could lead to remote information disclosure with no additional execution privileges required; exploitation requires user interaction. Connected s...

CVE-2017-14909

Technical details about CVE-2017-14909 are not publicly available in the provided documents. Monitor for updates from the connected sources.

CVE-2017-6211

CVE-2017-6211: In Android for MSM, Firefox OS for MSM, QRD Android (CAF Linux kernel builds), a buffer overflow in the processing of a downlink supplementary services message is reported. The vulnerability is triggered remotely over the network and, according to the CVSS data, could lead to a com...

CVE-2017-6247

CVE-2017-6247 affects the NVIDIA Tegra kernel audio driver (Audio DSP). A vulnerability in the driver allows an attacker to copy an invalid user parameter without proper input size checking, potentially leading to denial of service or privilege escalation to the kernel. Impact is described as loc...

CVE-2018-9370

CVE-2018-9370 affects the MediaTek bootloader in the Android platform, describing a vulnerability in download.c where a special mode allows data to be downloaded into memory with missing bounds checks, leading to possible memory corruption and local escalation of privilege. The exploitation requi...

CVE-2018-9420

CVE-2018-9420 affects Android’s BnCameraService::onTransact in CameraService.cpp, enabling information disclosure via uninitialized data with local access and no user interaction. The issue is categorized as an Information Disclosure (ID) in the Android 2018-07-01/2018-07-05 patch-level bulletin,...

CVE-2019-20614

The CVE-2019-20614 entry concerns Samsung mobile devices running N(7.x), O(8.x), and P(9.0) where the Allshare component can let attackers access sensitive information. The available sources (NVD entry and Red Hat advisory) confirm the affected platform and the vulnerability description but do no...

CVE-2019-2145

CVE-2019-2145 is a vulnerability in the Android libxaac library (Android-10) causing an information-disclosure via an out-of-bounds read due to missing bounds checks. The exploit requires user interaction and could allow partial confidentiality impact, with higher impact if exploited in context. ...

CVE-2019-9290

CVE-2019-9290 affects the tzdata component in Android 10, where a mismatch between allocation and deallocation can cause memory corruption. This could enable local privilege escalation without user interaction. The Android 10 security release notes indicate this issue is addressed by patches in t...

CVE-2019-9386

CVE-2019-9386 affects Android 10 NFC server: a missing bounds check leads to an out-of-bounds write that could enable local escalation of privilege in the system server. Exploitation requires user interaction. The issue is documented across multiple sources (NVD, Red Hat CVE, PRION) with the Andr...

CVE-2020-0293

CVE-2020-0293 affects Android 11 via the Java network APIs where a missing permission check can allow access to sensitive network state, leading to local information disclosure without extra execution privileges. The vulnerability is described as requiring no user interaction for exploitation and...

CVE-2020-11600

Samsung mobile devices with Q(10.0) software are affected by CVE-2020-11600, where an arbitrary code execution in the Fingerprint Trustlet can occur via a memory overwrite (SVE-2019-16587, SVE-2019-16588, SVE-2019-16589). The provided sources confirm the vulnerability vector and impact but do not...

CVE-2020-26604

CVE-2020-26604 affects Samsung Android SystemUI across O(8.x) to R(11.0). The issue enables a network-sourced attack via PendingIntent where an unprivileged process can access contact numbers. Affected component: SystemUI on Samsung devices; root cause: incorrect handling of PendingIntent permiss...

CVE-2021-0380

CVE-2021-0380 affects Android 11 via DcTracker.java onReceive, where a missing permission check allows triggering a provisioning URL and altering telephony settings, enabling local elevation of privilege during onboarding without extra privileges. Exploitation requires no user interaction per the...

CVE-2021-1013

CVE-2021-1013 affects Android 12 (e.g., Pixel devices). In PermissionManagerService.java’s checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission, a side-channel information-disclosure path can determine whether an app is installed without query permissions. This enables local information...

CVE-2021-1037

The CVE-2021-1037 issue concerns a broadcast from the DevicePickerFragment when a new device is paired that lacks permission checks. Affected software: Android 9–12. Vulnerable component/behavior: the DevicePickerFragment broadcast is listenable by any app without BLUETOOTH permissions, enabling ...

CVE-2021-25334

CVE-2021-25334 concerns an improper input validation in Samsung mobile devices’ wallpaper service. The vulnerability could allow an untrusted application to cause a permanent denial of service, due to an input check flaw in the wallpaper service. Affected products are Samsung mobile devices (prio...

CVE-2021-25360

CVE-2021-25360 affects the libswmfextractor library prior to Samsung SMR APR-2021 Release 1. The root cause is improper input validation, which allows attackers to execute arbitrary code on the mediaextractor process. Remediation: update to SMR APR-2021 Release 1 or later. Exploitation details ar...

CVE-2022-20275

CVE-2022-20275 affects Android 13 devices due to a side-channel disclosure in the DevicePolicyManager that can reveal whether an app is installed without query permissions. The root cause is a information-disclosure path that enables local access to installation state without user interaction or ...

CVE-2022-20306

CVE-2022-20306 affects Android 13 via the Camera Provider HAL. The issue is a memory corruption due to a use-after-free in the Camera Provider HAL, enabling local elevation of privileges with SYSTEM rights and no user interaction required. The vulnerability impact is described as local EoP with h...

CVE-2022-20309

CVE-2022-20309 affects Android 13, specifically the PackageInstaller component. The issue is a side-channel information disclosure that can determine whether an app is installed without query permissions, leading to local information disclosure with no additional execution privileges required. Ex...

CVE-2022-20310

The CVE-2022-20310 entry concerns Android 13 Telecomm. A missing permission check could allow disclosure of registered self‑managed phone accounts, causing local information disclosure. Exploitation requires user privileges but does not require user interaction. The issue is categorized under Tel...

CVE-2022-20328

CVE-2022-20328 affects Android 13 and relates to the PackageManager. The vulnerability arises from a missing permission check that can allow an attacker to determine whether an app is installed, enabling local information disclosure without requiring additional execution privileges. Exploitation ...

CVE-2022-20330

CVE-2022-20330 : In Android 13, a missing Bluetooth permission check allows connecting or disconnecting Bluetooth devices without user awareness, enabling local elevation of privilege. Exploitation requires low privileges and does not require user interaction (UI: NONE). Impact is limited to elev...

CVE-2022-20531

The provided connected documents confirm CVE-2022-20531 affects Android’s Telecom component, describing a side-channel information disclosure that lets an app determine if another app is installed without query permissions. This enables local information disclosure with no extra execution privile...

CVE-2022-21790

The CVE-2022-21790 issue concerns MediaTek camera ISP hardware where a missing bounds check allows an out-of-bounds read. This can lead to local information disclosure with system-level privileges required; exploitation does not require user interaction. A fix is identified as patch ALPS06479306 ...

CVE-2022-26452

CVE-2022-26452 affects the isp component, describing a use-after-free caused by improper locking. The vulnerability enables local escalation of privilege with System execution privileges required and does not require user interaction. The available connected documents consistently cite a patch id...

CVE-2022-26468

CVE-2022-26468: Out-of-bounds write in the preloader (usb) on MediaTek devices due to a missing bounds check. This can lead to local privilege escalation with physical access and requires user interaction for exploitation. Patch ID ALPS07168125/Issue ALPS07168125 appears in the record; no specifi...

CVE-2022-39114

CVE-2022-39114 describes a missing permission check in the Music service that can lead to a local denial of service without requiring additional execution privileges. The NVD entry assigns a CVSS v3.1 base score of 5.5 (Local, Low attack complexity, Low privileges required, Availability impact), ...

CVE-2022-39117

CVE-2022-39117 involves a missing permission check in the messaging service, enabling local information disclosure without additional execution privileges. Multiple connected sources (NVD/NVD-derived records, Red Hat, PRION, CNNVD, and others) describe the issue as a local confidentiality exposur...

CVE-2022-39126

CVE-2022-39126 affects the sensor driver with an out-of-bounds write caused by a missing bounds check, leading to local kernel denial of service. Multiple sources (NVD, Red Hat, CNNVD, PRION, etc.) reproduce the description and tie it to Unisoc chipsets (sensor driver). The documents do not provi...