CVE-2018-9479

CVE-2018-9479 concerns an out-of-bounds write in the Bluetooth SDP server logic (sdp_server.cc) within functions process_service_attr_req and process_service_search_attr_req. The issue, observed across sources including Red Hat and NVD descriptions, could enable remote code execution without addi...

CVE-2019-20562

Summary: CVE-2019-20562 affects Samsung mobile devices running P(9.0) with TEEGRIS. The issue is a buffer overflow in the BIOSUB Trustlet. The description in connected sources consistently mirrors this, with no publicly disclosed exploitation details in the provided documents. The CVSS data (NVD)...

CVE-2019-2063

CVE-2019-2063 affects Android 10 via libxaac where an out-of-bounds write is caused by a missing bounds check. The issue can lead to remote code execution in the media server, requiring user interaction to exploit. The CVE is documented by NVD with a high-severity vector (CVSS 3.1: AV:N/AC:L/PR:N...

CVE-2019-2066

CVE-2019-2066 is an out-of-bounds write in libxaac on Android 10 that can lead to remote code execution. The vulnerability arises from a missing bounds check in libxaac, with exploitation requiring user interaction. Affected components: libxaac within Android 10. Reported impact includes remote c...

CVE-2019-2129

CVE-2019-2129 affects Android's Media/MR components (TextDescriptions.cpp, extract3GPPGlobalDescriptions) with an out-of-bounds read that can lead to remote information disclosure. Impact: no execution privileges required; user interaction is needed. Affected Android versions include 7.0–9. Patch...

CVE-2019-9287

CVE-2019-9287 is a Bluetooth-related information disclosure in Android 10 caused by a missing bounds check that enables a local out-of-bounds read. The vulnerability allows local disclosure without user interaction and with only local access; no remote code execution is described. The issue is la...

CVE-2019-9310

CVE-2019-9310 affects Android 10 in the libFDK component, where an out-of-bounds write caused by an integer overflow could lead to remote code execution with no privileges. Exploitation requires user interaction. See Android 10 security notes; the vulnerability is listed under the Media Framework...

CVE-2019-9420

CVE-2019-9420 describes an out-of-bounds read in the Android media stack (libhevc) caused by an integer overflow. This can lead to a remote denial-of-service on Android 10 devices, with exploitation requiring user interaction. The available connected documents confirm the issue location (libhevc)...

CVE-2019-9422

CVE-2019-9422 affects the Android 10 Bluetooth stack, where an out-of-bounds read due to a missing bounds check could lead to remote information disclosure without user interaction. The entry can be exploited over the network (per CVSS). The vulnerability is addressed in the Android 10 security r...

CVE-2020-0102

In CVE-2020-0102, the issue is an out-of-bounds write in GattServer::SendResponse due to an incorrect bounds check. Affects Android 8.0–10; exploitation could enable local elevation of privilege with user execution privileges required and no user interaction needed. The risk is described as a loc...

CVE-2020-11600

Samsung mobile devices with Q(10.0) software are affected by CVE-2020-11600, where an arbitrary code execution in the Fingerprint Trustlet can occur via a memory overwrite (SVE-2019-16587, SVE-2019-16588, SVE-2019-16589). The provided sources confirm the vulnerability vector and impact but do not...

CVE-2021-0367

The CVE-2021-0367 entry describes a race-condition induced memory corruption in Android’s vpu component, enabling local escalation of privilege with System permissions required and no user interaction. Affected products are Android 10 and Android 11; the issue is tied to patch ALPS05371580 (Issue...

CVE-2021-0996

CVE-2021-0996 affects Android 12 where the out-of-bounds read occurs in nfaHciCallback within HciEventManager.cpp due to a missing bounds check. This leads to local information disclosure over NFC with System privileges required for exploitation, and does not require user interaction. Connected s...

CVE-2021-25334

CVE-2021-25334 concerns an improper input validation in Samsung mobile devices’ wallpaper service. The vulnerability could allow an untrusted application to cause a permanent denial of service, due to an input check flaw in the wallpaper service. Affected products are Samsung mobile devices (prio...

CVE-2021-25360

CVE-2021-25360 affects the libswmfextractor library prior to Samsung SMR APR-2021 Release 1. The root cause is improper input validation, which allows attackers to execute arbitrary code on the mediaextractor process. Remediation: update to SMR APR-2021 Release 1 or later. Exploitation details ar...

CVE-2022-20255

The CVE-2022-20255 issue affects Android 13 (SettingsProvider). A missing permission check could allow a local attacker to read or modify the default ringtone, enabling local elevation of privilege without extra execution privileges and without requiring user interaction. The vulnerability is doc...

CVE-2022-20287

CVE-2022-20287 affects Android 13, specifically the AppSearchManagerService. The issue lets a local attacker determine whether an app is installed without query permissions via a side-channel information disclosure, causing local information disclosure with no extra execution privileges needed. E...

CVE-2022-20310

The CVE-2022-20310 entry concerns Android 13 Telecomm. A missing permission check could allow disclosure of registered self‑managed phone accounts, causing local information disclosure. Exploitation requires user privileges but does not require user interaction. The issue is categorized under Tel...

CVE-2022-20319

CVE-2022-20319 affects Android 13 via DreamServices, where a confused deputy could launch arbitrary protected activities, causing local escalation of privilege. Exploitation is described as local (attack vector: LOCAL) with low privileges required and no user interaction needed, potentially eleva...

CVE-2022-20335

CVE-2022-20335 (Android 13) affects the Wifi Slice component where a missing permission check allows an attacker to adjust Wi‑Fi settings, enabling local escalation of privilege with no user interaction required. Root cause: insufficient permission validation in the Wifi Slice flow. Impact: local...

CVE-2022-22269

CVE-2022-22269 – concrete details found. The vulnerability concerns an unprotected BluetoothSettingsProvider on Samsung Android devices prior to the SMR Jan-2022 Release 1. This leakage enables untrusted applications with local access to read the device’s Bluetooth MAC address. Root cause: Blueto...

CVE-2022-26463

The CVE-2022-26463 issue affects vow (MediaTek vow) and involves an out-of-bounds read caused by an incorrect bounds check. The vulnerability could lead to local information disclosure with System execution privileges required, and no user interaction is needed to exploit. Public references in th...

CVE-2022-26466

The CVE-2022-26466 entry concerns the Mediatek audio IPI component. The root cause is an integer overflow that enables an out-of-bounds write, resulting in local privilege escalation with SYSTEM privileges required and no user interaction needed. Public references indicate a patch identified as A...

CVE-2022-32643

CVE-2022-32643: In ccd, a race condition can cause a use-after-free, enabling local privilege escalation with SYSTEM privileges required and no user interaction. The vulnerability is described with Patch ID ALPS07341261/Issue ID ALPS07341261. Exploitation details are not provided in the connected...

CVE-2022-33689

The CVE-2022-33689 entry concerns Samsung TelephonyUI with an improper access control issue. Affected software: TelephonyUI prior to the SMR July 2022 Release 1. Root cause: lack of proper permission checks allows an unprotected binder call to change the device’s preferred network type. Impact: a...

CVE-2022-36853

The CVE-2022-36853 issue affects Samsung Photo Editor (on Samsung mobile devices) prior to the SMR Sep-2022 Release 1. Root cause: intent redirection in Photo Editor that may disclose sensitive information. Impact: enables information disclosure to an attacker without user interaction (per NVD me...

CVE-2022-39125

The CVE-2022-39125 entry concerns a vulnerability in a sensor driver where a missing bounds check can cause an out-of-bounds write, leading to local denial of service in the kernel. The data in connected sources consistently describe the issue as a sensor-driver boundary-check failure affecting k...

CVE-2022-39899

CVE-2022-39899 is an improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1. The issue can allow a local attacker to send input events via S Pen gestures due to insufficient authentication around the WindowManagerService. Affected software is Samsung...

CVE-2022-47354

CVE-2022-47354 involves a missing permission check in the log service, enabling local denial of service. The connected documents consistently describe the root cause as a lack of privilege validation within the log service, leading to a local impact (DoS) without remote execution. Specific affect...

CVE-2022-47453

CVE-2022-47453 affects the wcn service , with the root cause stated as a missing parameter check. The consequence described is a local denial of service in the wcn service. The connected documents confirm the issue but do not provide specific vendor/version details or a confirmed patch/fix. No ex...

CVE-2022-47458

CVE-2022-47458 affects the UNISOC chipsets WLAN module (wlan driver) with a vulnerability caused by missing parameter checks. This can lead to local denial of service in the WLAN service. The connected documents confirm the root cause is parameter validation issues and indicate local exploitation...

CVE-2022-47464

CVE-2022-47464 describes a missing permission check in the telecom service, enabling local denial of service. Affected: telecom service component; root cause: insufficient permission validation. Impact: local DoS with high availability impact as per CVSS 3.1 vector. Exploitation details are not p...

CVE-2023-20650

The CVE-2023-20650 entry describes a vulnerability in MediaTek chips’ apu module: an out-of-bounds write from a missing bounds check, enabling local escalation of privilege to System level. No exploitation details are provided in the documents. CVSSv3.1/3.1 base score 6.7 (MEDIUM); attack vector ...

CVE-2023-20659

CVE-2023-20659 concerns a local out-of-bounds write in the WLAN path of a MediaTek/ALPS component, caused by a missing bounds check. The issue can lead to local privilege escalation with System execution privileges needed; exploitation does not require user interaction. The patch reference provid...

CVE-2023-20737

The CVE-2023-20737 issue concerns the vcu component in MediaTek devices, where an improper locking leads to a use-after-free condition. This vulnerability can enable local escalation of privileges to SYSTEM with no user interaction required. Affected behavior is described as a local exploit path,...

CVE-2023-21312

CVE-2023-21312 affects Android's IntentResolver, enabling cross-user media read via a confused deputy and resulting in local information disclosure without extra privileges. Exploitation is described as non-interactive and local, with no user interaction required and no remote access. There are m...

CVE-2023-21313

CVE-2023-21313 affects Android Core with a missing permission check that allows forwarding calls without user knowledge, enabling local elevation of privilege. Exploitation requires Local access; UI interaction is not needed. The CVSSv3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates hig...

CVE-2023-21343

CVE-2023-21343 affects Android’s ActivityStarter where an unsafe PendingIntent can trigger a background activity launch, enabling local elevation of privilege without user interaction. Affected component: ActivityStarter (framework). Root cause: unsafe PendingIntent that can be exploited locally....

CVE-2023-21353

CVE-2023-21353 affects a component labeled NFA in Android, where a missing bounds check can cause an out-of-bounds read. The resulting vulnerability leads to remote information disclosure without requiring privileges or user interaction. Documents consistently describe the impact as information d...

CVE-2023-21355

CVE-2023-21355 affects the Android libaudioclient component. The issue is an out-of-bounds write caused by a use-after-free, leading to a possible local escalation of privilege. No extra execution privileges are required, and exploitation does not require user interaction. The description indicat...

CVE-2023-21362

CVE-2023-21362 affects Google Android (Android Framework). The issue is a DoS caused by resource exhaustion that can lead to local denial of service without extra privileges. The available documents cite it as a Framework DoS in Android 14 release notes, with no exploitation details provided. Mit...

CVE-2023-21374

The CVE-2023-21374 entry concerns Android System UI: a logic error that enables a factory reset protection bypass, leading to local elevation of privilege with no extra execution privileges and no user interaction required. Affected component: System UI on Android; vulnerability type is Elevation...

CVE-2023-42641

CVE-2023-42641 affects the component validationtools . The root cause, as described in the connected records, is a missing permission check that could lead to local information disclosure without any additional execution privileges. The issue is consistently reported across multiple sources (NVD,...

CVE-2023-52343

A security vulnerability exists in UNISOC Chipsets (manufactured by UNISOC / Purple Spreadtrum) due to improper input validation in the SecurityCommand message after security has been activated. This flaw could allow for remote information disclosure without requiring additional execution privile...

CVE-2024-20089

CVE-2024-20089 affects MediaTek wlan in various MediaTek chipsets. The vulnerability stems from incorrect error handling in the wlan component, enabling a remote denial of service without user interaction. The issue is classified with a HIGH impact (Availability) and NETWORK attack vector, with n...

CVE-2025-36887

A high-severity elevation of privilege vulnerability exists in the WLAN subcomponent of Google Pixel devices. The root cause is an out-of-bounds write occurring in the wl_cfgscan_update_v3_schedscan_results() function within wl_cfgscan.c due to an incorrect bounds check. This flaw allows for loca...

CVE-2025-48533

Google Android is impacted by a High severity Elevation of Privilege (EoP) vulnerability (CVE-2025-48533) affecting the Framework component. The issue stems from a race condition in multiple locations, which could allow an attacker to use apps linked from a lockscreen app context menu. Successful...

CVE-2026-0048

Technical details for CVE-2026-0048 are not publicly provided in the supplied documents. The description notes a tapjacking/overlay issue with local privilege escalation, but no concrete affected products, versions, or fixes are disclosed. Monitor for updates.

CVE-2026-0081

CVE-2026-0081 concerns the Android NFC stack. The connected documents indicate a missing permission check in NFC that could allow spoofing an NFC event, enabling local escalation of privilege without any additional execution privileges and without user interaction. The exploitation details are no...

CVE-2013-7373

CVE-2013-7373 affects Android versions before 4.4, where the OpenSSL PRNG seeding is inadequate. This weakens cryptographic protections because the PRNG may be reused across multiple applications, potentially reducing confidentiality, integrity, and availability. The vulnerability is documented a...