CVE-2019-2170

CVE-2019-2170 is an information-disclosure vulnerability in the libxaac library on Android 10 caused by uninitialized data. Impact: potential information exposure without full execution privileges; CVE description notes user interaction is required for exploitation, with confidentiality impact ra...

CVE-2019-9250

CVE-2019-9250 affects Android 10 Bluetooth, describing an out-of-bounds read due to a missing bounds check that can lead to remote information disclosure. Impact is high (per CVSS 3.1: HIGH, confidentiality impact HIGH) with no user interaction required. Exploitation status is not detailed in the...

CVE-2019-9299

CVE-2019-9299 affects the Android 10 Media Framework (libAACdec). The issue is an out-of-bounds write caused by an integer overflow, potentially enabling remote code execution. Exploitation requires user interaction and can be network-reachable per the CVE details. Remediation is to apply the And...

CVE-2019-9304

CVE-2019-9304 affects the Android 10 Media Framework, specifically the libMpegTPDec component. The issue is a possible out-of-bounds write caused by an integer overflow in a decoding path, which could enable remote code execution. Exploitation requires user interaction, and the risk is tied to th...

CVE-2019-9372

In CVE-2019-9372, the issue is in libskia on Android 10 where a missing null check can cause a crash, resulting in remote denial of service. The CVSS metrics indicate NETWORK attack vector, low attack complexity, no privileges required, and user interaction required, with an availability impact o...

CVE-2020-0023

CVE-2020-0023 affects Android 10 and is described as a local information disclosure in which a Bluetooth-enabled app could access user contacts due to a missing permission check in AdapterService.java. The vulnerability occurs in setPhonebookAccessPermission and could allow a malicious app to dis...

CVE-2020-0035

Technical details for CVE-2020-0035 are not provided in the connected documents; the available materials describe a local information disclosure in TelephonyProvider.java affecting Android 8.0–9. Monitor for updates.

CVE-2020-0039

CVE-2020-0039 affects Android 8.0–10 via an out-of-bounds read in rw_i93_sm_update_ndef (rw_i93.cc) caused by a missing bounds check, enabling potential remote information disclosure with no user interaction. The issue is categorized as Information Disclosure (Android 8–10) with network-based exp...

CVE-2020-11875

CVE-2020-11875 affects LG mobile devices running Android 8.0–10.0 with MTK chipsets. The MTK kernel is reported to mishandle exceptions, enabling local privilege escalation for an attacker (privileges gained via local access). Documents show a high-severity impact (NVD CVSS v3.1: 7.8, HIGH; v2: 7...

CVE-2020-26603

CVE-2020-26603 affects Samsung mobile devices running O(8.x), P(9.0), and Q(10.0). The issue is in Sticker Center, allowing a directory traversal by an unprivileged process to read arbitrary files. Samsung ID SVE-2020-18433 (October 2020) is referenced. Connected documents confirm the vulnerabili...

CVE-2021-0420

CVE-2021-0420 concerns a missing bounds check in the in-memory management driver, enabling local denial of service without user interaction. Impact is described as a system crash leading to local DoS; exploitation details are not provided in the documents. Mitigation references a patch: ALPS05403...

CVE-2021-0623

CVE-2021-0623 affects the asf extractor component. The linked records describe an out-of-bounds read caused by an integer overflow, leading to local information disclosure without requiring user interaction. The vulnerability is documented across multiple sources (including NVD and vendor/Red Hat...

CVE-2021-1041

CVE-2021-1041 is documented in multiple sources as a local, memory-corruption–related information-disclosure vulnerability affecting Android kernel components, with Pixel’s bulletin identifying it under the Camera entry and rating it High severity. The core issue is described as an out-of-bounds ...

CVE-2021-39652

CVE-2021-39652 affects the Android kernel component, specifically the sec_ts_parsing_cmds code. The root cause is an incorrect bounds check that can trigger an out-of-bounds write, enabling local escalation of privilege with SYSTEM-level execution rights. Exploitation requires no user interaction...

CVE-2022-20254

CVE-2022-20254 affects Android 13 Wi‑Fi: a permissions bypass allows local escalation of privilege from a guest user with no extra privileges and no user interaction required. The vulnerability is described across multiple sources (Android 13 security release notes and CVE entries) as a Wi‑Fi per...

CVE-2022-20326

CVE-2022-20326 affects Android 13 Telephony: a missing permission check allows disclosure of SIM identifiers via local information disclosure with low privileges and no user interaction. The issue is categorized as Information Disclosure/Telephony, with impact limited to confidential data exposur...

CVE-2022-20327

The CVE-2022-20327 entry concerns Android 13 where there is a vulnerability allowing retrieval of the WiFi SSID without location permissions due to a missing permission check. This enables local information disclosure with user execution privileges, and exploitation requires user interaction. The...

CVE-2022-21760

The CVE-2022-21760 entry affects the apusys driver, where an integer overflow can cause a system crash. This leads to local denial of service with SYSTEM privileges required, and no user interaction is needed for exploitation. Root cause: integer overflow in the apusys driver. A patch is availabl...

CVE-2022-21778

The CVE-2022-21778 issue affects MediaTek’s vpu, where an incorrect bounds check can trigger information disclosure and potentially local privilege escalation. The vulnerability requires local access (attack vector: LOCAL), with no user interaction, and a high privileges requirement for exploitat...

CVE-2022-21790

The CVE-2022-21790 issue concerns MediaTek camera ISP hardware where a missing bounds check allows an out-of-bounds read. This can lead to local information disclosure with system-level privileges required; exploitation does not require user interaction. A fix is identified as patch ALPS06479306 ...

CVE-2022-26427

CVE-2022-26427: In camera isp, there is an out-of-bounds write due to a missing bounds check that can lead to local privilege escalation with System execution privileges required. No user interaction is needed. Patch ALPS07085540 / Issue ALPS07085540. Public references point to MediaTek/ALPS advi...

CVE-2022-26449

Summary: CVE-2022-26449 concerns the MediaTek Apusys component, with an out-of-bounds write caused by a missing bounds check that can enable local privilege escalation without user interaction. Affected component: apusys (MediaTek Apusys chipset). Root cause and impact (as stated): out-of-bounds ...

CVE-2022-26464

CVE-2022-26464 is a vulnerability described in IBM Datacap-related advisories as an out-of-bounds write in vow that can lead to local privilege elevation. The IBM bulletin lists affected products/versions as Datacap Navigator 9.1.7, 9.1.8, and 9.1.9, with a remediation recommendation to upgrade t...

CVE-2022-36854

The CVE-2022-36854 issue affects the library libapexjni.media.samsung.so (Samsung), with an out-of-bounds read that could allow an attacker to access unauthorized information. Connected documents consistently identify the vulnerable component as libapexjni.media.samsung.so and cite the root cause...

CVE-2022-39847

The CVE-2022-39847 entry concerns a use-after-free vulnerability in the NFC driver’s set_nft_pid and signal_handler functions on Samsung devices prior to the SMR Oct‑2022 Release 1. Affected component: NFC driver (Samsung Mobile). Root cause: use-after-free in specific NFC driver handlers, enabli...

CVE-2022-39884

CVE-2022-39884 is an improper access control issue in IImsService prior to Samsung SMR Nov-2022 Release 1 that could allow a local attacker to access Call information. Documented impact is local and requires low attack complexity with local access; no public exploit details are provided in the co...

CVE-2022-42778

The CVE-2022-42778 entry concerns a missing permission check in the Windows Manager Service, described across multiple sources. The root cause is that the service could be set up without requiring additional execution privileges, enabling potential unauthorized setup. Documents consistently ident...

CVE-2022-44439

CVE-2022-44439: Connected sources describe a missing permission check in the messaging service that could permit a local denial of service affecting the contacts service without requiring additional execution privileges. The vulnerability is evaluated with CVSSv3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:...

CVE-2022-47325

The CVE-2022-47325 entry concerns the WLAN driver where a missing permission check could allow local information disclosure. Several connected sources (NVD, Red Hat, CVE listing, PRION, CNNVD) consistently describe this issue as a local-information-disclosure vulnerability in the WLAN driver, cau...

CVE-2022-47370

The CVE-2022-47370 entry concerns the WLAN driver. A missing parameters check in the WLAN driver is described as allowing local denial of service in WLAN services. Affected component: WLAN driver (details about specific hardware/vendor not provided in the documents). Root cause: missing parameter...

CVE-2022-47466

CVE-2022-47466 is described across connected sources as a missing permission check in the telecom service that could cause local denial of service. Documents cite the root cause and impact (local DoS) but do not provide concrete vendor/product versions or a remediation. Exploitation details are n...

CVE-2022-47467

The CVE-2022-47467 issue is a missing permission check in the telecom service component, enabling local denial of service. Affected context repeatedly ties this to UNISOC chipsets and telecom service workflows, but concrete vulnerable versions are not specified in the provided documents. The vuln...

CVE-2022-47483

The CVE-2022-47483 entry describes a missing permission check in the telephony service, enabling local denial of service with no additional privileges. Connected documents reaffirm this issue across multiple sources (e.g., Red Hat, NVD, PRION, CNNVD) but do not provide product/vendor/version or a...

CVE-2023-20610

CVE-2023-20610 describes a memory corruption risk in the MediaTek display DRM stack caused by a race condition, enabling local escalation of privilege with System execution privileges required and no user interaction. The vulnerability affects the display DRM component; the root cause is a race c...

CVE-2023-20660

CVE-2023-20660 affects the WLAN component in MediaTek devices, with an out-of-bounds read caused by an integer overflow that can lead to local information disclosure. Exploitation requires SYSTEM-level privileges, and no user interaction is needed. A patch is referenced (ALPS07588383 / ALPS075883...

CVE-2023-20724

The CVE-2023-20724 entry concerns MediaTek Bluetooth implementations. A missing bounds check in the Bluetooth module enables an out-of-bounds read, leading to local escalation of privilege with System-level execution privileges; exploitation requires no user interaction. The vulnerability affects...

CVE-2023-20781

In keyinstall, a memory corruption vulnerability is caused by a missing bounds check, enabling local denial of service with SYSTEM privileges without user interaction. Affects the keyinstall component; exploitation details are not provided beyond the local-privilege context. The issue is associat...

CVE-2023-20833

The CVE-2023-20833 issue concerns MediaTek devices featuring the keyinstall component. A missing bounds check in keyinstall is reported to cause local information disclosure, with the prerequisite that system execution privileges are required and no user interaction is needed for exploitation. Th...

CVE-2023-21315

CVE-2023-21315 describes a heap-based out-of-bounds read in Bluetooth that could cause remote information disclosure without require­ing privileges or user interaction. The NVD entry assigns CVSSv3.1: AV=Adjacent, AC=L, PR=NONE, UI=NONE, S=U, C=H, I=N, A=N with a base score of 6.5 (Medium). The A...

CVE-2023-21326

Summary of CVE-2023-21326 : This Android vulnerability affects the Package Manager Service and allows a local attacker to determine whether an app is installed without query permissions, via a side-channel information disclosure. The impact is information disclosure (confidentiality) with no user...

CVE-2023-21334

CVE-2023-21334 affects Android's App Ops Service. A logic error allows an attacker with local access to disclose information about installed packages without requiring extra execution privileges or user interaction. The vulnerability is documented across multiple sources (NVD/Red Hat/CNNVD) with ...

CVE-2023-21357

The vulnerability CVE-2023-21357 affects Android NFC and is due to a missing bounds check that enables an out-of-bounds read. This can lead to local information disclosure, with the potential for System-level execution privileges, and does not require user interaction to exploit. Public details c...

CVE-2023-21365

CVE-2023-21365 affects Android’s Phone app, where the Contacts component can enter a crash loop due to resource exhaustion. This leads to a local denial of service with User privileges required and no user interaction needed. Public details from the provided sources confirm the DoS impact and loc...

CVE-2023-32825

The CVE-2023-32825 entry documents an out-of-bounds read in the bluethooth service due to improper input validation, enabling local information disclosure without user interaction. The vulnerability affects the bluethooth component described in the MediaTek context and is associated with patch AL...

CVE-2023-40649

CVE-2023-40649 concerns a missing permission check in the Messaging component, leading to local information disclosure without requiring additional execution privileges. The Red Hat/NVD entries reiterate the same issue: an information-disclosure risk arising from insufficient access control withi...

CVE-2023-40652

CVE-2023-40652 concerns the jpg driver failing due to an out-of-bounds write caused by improper input validation. The vulnerability allows local denial of service with System execution privileges required, as stated in the NVD entry. Connected records corroborate the issue location but do not pro...

CVE-2023-42639

CVE-2023-42639 affects the validationtools component. The issue is a missing permission check that can allow local information disclosure without requiring additional privileges. The available sources (NVD, Red Hat, PRION, etc.) describe the vulnerability as a local-disclosure flaw and do not pro...

CVE-2023-52347

A security vulnerability exists in the ril service within UNISOC Chipsets due to a missing bounds check . This flaw can lead to an out-of-bounds write , potentially resulting in a local denial of service . Exploitation of this vulnerability requires System execution privileges . Currently, there ...

CVE-2023-52352

Summary: CVE-2023-52352 concerns the Network Adapter Service where a missing permission check could allow local denial of service without extra execution privileges. The connected documents link this vulnerability to UNISOC chipsets and multiple trackers (Red Hat, NVD, CVE list, PT Security, CNNV...

CVE-2024-20048

A security vulnerability exists in the flashc module of MediaTek chips due to an uncaught exception . This flaw could lead to local information disclosure , requiring System execution privileges for exploitation. No user interaction is required. While a patch ID (ALPS08541769 ) is referenced, spe...