CVE-2017-0816

CVE-2017-0816 is an information-disclosure vulnerability in Android’s media framework (libeffects). Affected products: Android releases listed in the CVE entry (4.4.4–8.0). The root cause is described as a vulnerability within the media framework that can disclose sensitive information. Public re...

CVE-2017-0822

CVE-2017-0822 is an Android camera elevation-of-privilege vulnerability affecting Android versions 6.0.1, 7.0, 7.1.1, 7.1.2 and 8.0. The connected documents confirm the vulnerability but do not provide concrete exploit details, affected component specifics beyond the camera subsystem, or remediat...

CVE-2017-0824

CVE-2017-0824 is a Privilege Elevation vulnerability in the Broadcom WiFi driver affecting Android kernel space. The issue enables elevation of privileges via the Broadcom WiFi component on affected Android devices. The vulnerability is categorized as EoP with a moderate impact in the Android eco...

CVE-2017-0829

CVE-2017-0829 is an elevation-of-privilege issue in the Motorola bootloader affecting Android kernel components. The linked records consistently describe this as a bootloader vulnerability that can elevate privileges on affected devices. The NVD entry summarizes it as controlling privilege escala...

CVE-2017-0839

CVE-2017-0839 is an information-disclosure in the Android media framework (libeffects) affecting Android 5.0.2–8.0. The issue is a information leak vulnerability in the Media Framework, with no exploited vectors detailed in the provided documents. The Android Security Bulletin lists this CVE unde...

CVE-2017-0845

CVE-2017-0845 is a denial-of-service vulnerability in the Android framework’s syncstorageengine. The issue affects Android devices running versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The vulnerability is categorized as DoS with network attack vector and authorship requires no user i...

CVE-2017-11014

CVE-2017-11014 describes a buffer overflow in the Android/CAF/Linux kernel stack when parsing a Measurement Request IE in a Roam Neighbor Action Report. Affected products include Android for MSM, Firefox OS for MSM, and QRD Android with CAF Linux kernel releases. The CVSS data indicates high impa...

CVE-2017-11059

CVE-2017-11059 describes a potential buffer overflow in Android for MSM, Firefox OS for MSM, QRD Android, and CAF Linux-kernel releases, caused by setting the HMAC key from different threads during SHA operations. The vulnerability is tied to how the HMAC key is handled under multi-threaded SHA p...

CVE-2017-13149

CVE-2017-13149 is a confirmed information-disclosure vulnerability in the Android media framework affecting Google Pixel/Nexus devices. Affected components: Media framework; affected Android versions include 7.0, 7.1.1, 7.1.2, and 8.0. The issue is categorized as information disclosure with moder...

CVE-2017-13171

The CVE-2017-13171 entry describes an elevation of privilege in the MediaTek performance service used by Android. Affected component: MediaTek performance service within the Android kernel stack. Root cause: local privilege escalation. Impact: attacker with local access could gain higher privileg...

CVE-2017-13311

The Android Framework is affected by an Elevation of Privilege (EoP) vulnerability caused by a read/write serialization issue in the read() function of ProcessStats.java. This flaw allows a local malicious application to bypass permissions and start an activity with system privileges without requ...

CVE-2017-13318

A security vulnerability exists in the Media framework of Google Pixel and Nexus devices, specifically within the HeifDecoderImpl.cpp file. An integer overflow in the HeifDataSource::readAt function can result in an out-of-bounds read , potentially leading to remote information disclosure without...

CVE-2017-14909

Technical details about CVE-2017-14909 are not publicly available in the provided documents. Monitor for updates from the connected sources.

CVE-2017-9720

CVE-2017-9720 affects Qualcomm camera driver in Android CAF Linux kernel builds, where an off-by-one error can trigger an out-of-bounds read/write. The vulnerability is listed under Qualcomm components as an Elevation of Privilege (EoP) risk with the camera driver as the affected component; expli...

CVE-2018-21054

CVE-2018-21054 describes an integer underflow causing a buffer overflow in eCryptFS on Samsung mobile devices running M(6.0), N(7.x), and O(8.x) (with some model/version exclusions). Affected component is eCryptFS; root cause is underflow leading to overflow, with potential impact across confiden...

CVE-2018-21055

CVE-2018-21055 affects Samsung mobile devices running N (Android 7.0) on Qualcomm MSM8996. The issue allows rooting via a custom image to run arbitrary scripts in the INIT context. Samsung assigns ID SVE-2018-11940 (Sept 2018). CVSS metrics indicate a critical impact (C/H, I/H, A/H) with network ...

CVE-2018-21072

CVE-2018-21072 affects Samsung mobile devices running M(6.0), N(7.x) and O(8.0) on Exynos chipsets. A kernel driver flaw enables out-of-bounds read/write and may allow arbitrary code execution (Samsung ID SVE-2018-11358). The connected documents confirm the vulnerability class and impact but do n...

CVE-2018-5907

The CVE-2018-5907 entry describes a vulnerability in the Qualcomm Audio DSP path: the function msm_adsp_stream_callback_put allows a buffer overflow due to insufficient input validation of user-provided data, leading to an integer overflow. Affected are Android for MSM, Firefox OS for MSM, and QR...

CVE-2018-9351

The CVE-2018-9351 issue affects the ih264e_fmt_conv_420p_to_420sp function in ih264e_fmt_conv.c, where a missing bounds check allows an out-of-bounds read. This can lead to a remote denial of service with no extra privileges required, and user interaction is needed to exploit. Connected records (...

CVE-2018-9356

CVE-2018-9356 affects Android, with a vulnerability in bnep_data_ind of bnep_main.c that allows remote code execution via a double free. The issue is exploitable over the network without user interaction and could grant full compromise of the device, as indicated by CVSS metrics (high/critical im...

CVE-2018-9361

CVE-2018-9361 describes an out-of-bounds read in process_l2cap_cmd of l2c_main.cc, leading to remote information disclosure without extra privileges and no user interaction. Multiple sources align on Android impact across versions 6.0–8.1. The vulnerability affects Bluetooth L2CAP handling; the u...

CVE-2018-9371

A vulnerability exists in the Mediatek Preloader component of the Google Android bootloader. Due to an exposed interface with insufficient blacklisting or whitelisting, the system is susceptible to out of bounds reads and writes via arbitrary peripheral memory mapping. This flaw can lead to local...

CVE-2018-9406

CVE-2018-9406 concerns a vulnerability in NlpService where a missing permission check could allow access to location information, enabling local privilege escalation without additional execution privileges. The exploit requires only local access and does not require user interaction. Affected com...

CVE-2018-9430

CVE-2018-9430 is an out-of-bounds write in btif_storage.cc (prop2cfg) that can lead to remote code execution without user interaction. Affected: Android Pixel/Nexus devices; root cause described as incorrect bounds check triggering a write beyond limits. Impact: high (RCE), network attack vector ...

CVE-2018-9456

CVE-2018-9456 affects Google Android components, specifically the SDP utility: sdpu_extract_attr_seq in sdp_utils.cc. The issue is a possible out-of-bounds read due to an incorrect bounds check, enabling remote denial-of-service without extra privileges or user interaction. Connected sources (Red...

CVE-2018-9493

CVE-2018-9493 affects Android’s Download Manager content provider, with an SQL injection due to improper input validation. This could lead to local information disclosure without extra privileges or user interaction. Affected Android versions include 7.0–9.0. The provided sources describe the iss...

CVE-2018-9550

CVE-2018-9550 : In CAacDecoder_Init of aacdecoder.cpp, Android 9 contains an out-of-bounds write leading to remote code execution. Exploitation requires user interaction. This is a Media Framework RCE issue reported in the Android 2018-12 bulletin; patches at the 2018-12-01/2018-12-05 levels addr...

CVE-2018-9585

The CVE-2018-9585 issue affects Android 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9 in the NFC subsystem. Root cause: a missing bounds check in nfc_ncif_proc_get_routing within nfc_ncif.cc leads to an out-of-bounds write. Impact: local elevation of privilege with no additional execution privileges needed;...

CVE-2019-20602

CVE-2019-20602 affects Samsung mobile devices running N(7.x), O(8.0), and P(9.0) on Qualcomm chipsets. The issue is a NULL pointer dereference in the Authnr Trustlet, identified by Samsung as SVE-2019-13949 (May 2019). Connected sources confirm the affected components and root cause but do not pr...

CVE-2019-20611

The CVE-2019-20611 entry describes a baseband stack overflow in Samsung mobile devices with Exynos chips (N7.x, O8.x, Go8.1, P9.0, Go9.0) leading to arbitrary code execution. Root cause: a stack overflow in the baseband firmware; impact: potential full device compromise with high privileges. Publ...

CVE-2019-2136

CVE-2019-2136 affects Android: the issue is in Status::readFromParcel of Status.cpp where an out-of-bounds read due to inadequate input validation can lead to local information disclosure without requires user interaction. Impact is confined to Android versions 7.0 through 9 as listed in the desc...

CVE-2019-2145

CVE-2019-2145 is a vulnerability in the Android libxaac library (Android-10) causing an information-disclosure via an out-of-bounds read due to missing bounds checks. The exploit requires user interaction and could allow partial confidentiality impact, with higher impact if exploited in context. ...

CVE-2019-9358

CVE-2019-9358 is an Android NFC vulnerability described as an out-of-bounds write caused by a missing bounds check, enabling local elevation of privilege with user interaction required. Affected product: Android 10 devices. The issue is documented in multiple sources (NVD entry and Android 10 Sec...

CVE-2019-9359

CVE-2019-9359 involves an information-disclosure issue in Android 10’s libavc component. The vulnerability arises from uninitialized data in the library, enabling remote information disclosure with the Android 10 device at risk. Exploitation details beyond the description are not provided in the ...

CVE-2019-9417

CVE-2019-9417 is a Bluetooth vulnerability in Android 10 where an out-of-bounds read can disclose information locally without user interaction due to a missing bounds check. Exploitation requires local access; impact is information disclosure with no execution privileges gained. Public references...

CVE-2019-9468

The CVE-2019-9468 issue affects Android 10 and is caused by a double free in export_key_der inside export_key.cpp, leading to memory corruption and local privilege escalation without user interaction. The vulnerability is categorized as EoP with high impact, as reflected in the Pixel Update Bulle...

CVE-2020-0064

CVE-2020-0064 is a MediaTek-specific issue (component: Omacp) documented in the Android May 2020 bulletin. It is classified as Information Disclosure (ID) with High severity and is linked to Android patch levels 2020-05-01 and later. The vulnerability arises from improper authorization when proce...

CVE-2020-0299

CVE-2020-0299 affects Android 11 via a Bluetooth component issue: spoofing of Bluetooth device metadata due to a missing permission check. This enables local elevation of privilege with user rights and no user interaction required. The vulnerability is documented across multiple sources (NVD, Red...

CVE-2020-26600

CVE-2020-26600 concerns Samsung mobile devices running Q(10.0). The issue involves the Auto Hotspot feature, which can allow a remote attacker to obtain sensitive information over the network. Key details from connected sources: Affected product area: Samsung Mobile Android distribution with Q(10...

CVE-2020-26607

Summary: CVE-2020-26607 describes a privilege-escalation issue in Samsung’s TimaService where a PendingIntent with an empty intent can be exploited by modifying the intent to perform a privileged action on affected devices (Samsung Android O(8.x), P(9.0), Q(10.0)). The Samsung vulnerability ID is...

CVE-2021-0380

CVE-2021-0380 affects Android 11 via DcTracker.java onReceive, where a missing permission check allows triggering a provisioning URL and altering telephony settings, enabling local elevation of privilege during onboarding without extra privileges. Exploitation requires no user interaction per the...

CVE-2021-1036

CVE-2021-1036 corresponds to an elevation-of-privilege vulnerability in Android’s LocationSettingsActivity via a tapjacking/overlay attack. Public records across NVD, Red Hat, CNVD and related sources confirm: affected products are Android 9–12 (and specifically AAOS references) with the vulnerab...

CVE-2021-25397

CVE-2021-25397 concerns an improper access control in Samsung TelephonyUI prior to SMR MAY-2021 Release 1. The issue allows a local attacker, via untrusted applications, to write arbitrary files within the telephony process. Documented impact across sources indicates local privilege escalation po...

CVE-2022-20021

CVE-2022-20021 involves the Bluetooth stack failing to handle multiple LMP_host_connection_req messages, enabling remote denial of service without additional privileges or user interaction. The issue is described across multiple feeds as a Bluetooth crash risk, including MediaTek chip references....

CVE-2022-20260

CVE-2022-20260 affects the Android Phone app on Android 13. The issue is a resource-exhaustion induced crash loop that can cause local persistent DoS with user privileges and no user interaction needed. The vulnerability is tied to the Phone app’s handling leading to a crash under resource pressu...

CVE-2022-20289

CVE-2022-20289 affects Android 13: a side-channel in PackageInstaller can reveal whether an app is installed without query permissions, causing local information disclosure with no user interaction. Root cause: information disclosure via PackageInstaller side channel. Impact: potential exposure o...

CVE-2022-20328

CVE-2022-20328 affects Android 13 and relates to the PackageManager. The vulnerability arises from a missing permission check that can allow an attacker to determine whether an app is installed, enabling local information disclosure without requiring additional execution privileges. Exploitation ...

CVE-2022-22267

Samsung ActivityMetricsLogger on mobile devices is affected by CVE-2022-22267: an implicit intent hijacking flaw that can disclose information about a running application. The vulnerability is tied to ActivityMetricsLogger before SMR Jan-2022 Release 1. Documented impact is information disclosure...

CVE-2022-26436

The vulnerability CVE-2022-26436 affects the emi mpu component and is caused by a missing bounds check, leading to an out-of-bounds read. This can lead to local information disclosure with System execution privileges required, and no user interaction is needed. A patch identified as ALPS07023666 ...

CVE-2022-26474

The CVE-2022-26474 entry describes a local privilege escalation in MediaTek sensorhub due to an out-of-bounds write from an incorrect buffer size calculation. Vulnerable component: sensorhub in affected MediaTek chips; root cause is incorrect buffer size calculation leading to out-of-bounds write...