CVE-2022-32609

CVE-2022-32609 affects the vcu component (MediaTek) and is caused by a race condition that enables a use-after-free. The issue can lead to local escalation of privilege with SYSTEM privileges required; exploitation does not require user interaction. Patch ALPS07203410/ALPS07203410 is referenced a...

CVE-2022-32651

In mtk-aie, there is a use-after-free caused by a logic error that can lead to local escalation of privilege with System execution privileges required. Exploitation does not require user interaction. Patch ID ALPS07225857 (Issue ID ALPS07225857) is noted as the fix in the CVE record. Multiple con...

CVE-2022-32653

The CVE-2022-32653 issue affects MediaTek’s mtk-aie, described as a use-after-free caused by a logic error that could allow local escalation of privilege with system execution privileges needed, no user interaction required. Multiple connected sources (Red Hat, CVE listings, PRION, CNNVD, PT-Secu...

CVE-2022-33698

CVE-2022-33698 describes an information-disclosure vulnerability in Samsung’s Telecom application on Samsung mobile devices. The underlying issue allows local attackers to access the ICCID via logs, i.e., sensitive hardware identifiers are exposed by log handling within the Telecom app. Affected ...

CVE-2022-33704

CVE-2022-33704 concerns an improper validation in KnoxSDK’s ucmRetParcelable prior to Samsung’s SMR Jul-2022 Release 1. The root cause is input validation failure in that function, which could allow an attacker to launch certain activities. Documents indicate remediation via Samsung’s Security Ma...

CVE-2022-36861

CVE-2022-36861 affects Samsung SystemUI prior to SMR Sep-2022 Release 1. It is described as a custom permission misuse that lets an attacker use some protected functions with SystemUI privilege. Root cause: misuse of a custom permission in SystemUI. Impact: potential elevation of privileges withi...

CVE-2022-39851

CVE-2022-39851 affects CocktailBarService on Samsung Mobile devices prior to SMR Oct-2022 Release 1. The issue is due to improper access control, enabling a local attacker to bind a service that requires the BIND_REMOTEVIEWS permission. The vulnerability is mitigated by updating to SMR Oct-2022 R...

CVE-2022-42541

CVE-2022-42541 is a Remote Code Execution vulnerability associated with Google Chromecast/Android Secure Monitor (AMLogic). Public sources in the connected documents describe a critical impact (CVSS v3.1: 9.8, Network attack vector, no authentication, no user interaction) affecting confidentialit...

CVE-2022-42763

The CVE-2022-42763 issue affects the wlan driver and is caused by a missing bounds check in the wireless subsystem. The exposed vulnerability could allow local denial of service to wlan services. Documented descriptions consistently identify the wlan driver as the vulnerable component and cite th...

CVE-2022-47330

CVE-2022-47330 is described as a possible missing permission check in the WLAN driver causing local information disclosure. The connected documents reiterate this description but do not provide concrete technical details such as affected products, versions, root cause specifics, exploitation stat...

CVE-2022-47357

CVE-2022-47357 involves a missing permission check in the log service, enabling local denial of service. The CVSS 3.1 base score is 5.5 (LOCAL attacker, LOW attack complexity, LOW privileges required, HIGH impact on availability). The available documents do not specify the affected vendor/product...

CVE-2022-47451

CVE-2022-47451 describes a missing parameters check in the WLAN driver that could allow a local denial of service in WLAN services. Multiple connected sources (NVD, Red Hat advisory, CNNVD, CVE listings, and PT security) consistently indicate the issue stems from insufficient validation in the WL...

CVE-2022-47468

CVE-2022-47468 is linked in connected documents to a vulnerability in UNISOC chipsets , described as a missing privilege/permission check that can cause a local denial of service . The root cause is stated as a lack of privilege checking leading to DoS; the Red Hat/NVD entries reiterate the same ...

CVE-2022-48370

CVE-2022-48370 describes a local information disclosure in the Unisoc dialer service due to a missing permission check. The vulnerability affects Unisoc chipsets’ dialer component and could allow access to sensitive data without extra execution privileges. No explicit affected version ranges or p...

CVE-2022-48377

CVE-2022-48377 concerns a vulnerability in the dialer service, where a missing permission check could allow a local denial of service without requiring additional privileges. Affected software appears tied to Unisoc/Unisoc-dialer components referenced across multiple records, but no precise produ...

CVE-2022-48379

CVE-2022-48379 concerns UNISOC chipsets where the dialer service lacks a permission check, enabling local denial of service without elevated execution privileges. The common details across sources indicate the root cause is insufficient permission validation in the dialer component, with an impac...

CVE-2023-20612

CVE-2023-20612 concerns an out-of-bounds write in the ril component due to a missing bounds check, potentially enabling local escalation of privilege with System-level execution requirements. Exploitation prerequisites indicate local access with high privileges and no user interaction required. T...

CVE-2023-20662

The CVE-2023-20662 entry describes a vulnerability in the wlan component where an integer overflow causes an out-of-bounds write. This could enable local escalation of privilege with SYSTEM-level execution privileges and requires no user interaction. A patch is identified as ALPS07560765 (Issue A...

CVE-2023-20673

The CVE-2023-20673 entry describes a memory corruption via type confusion in the vcu module of MediaTek chips, enabling local escalation of privileges with System execution privileges required. Impact is high for confidentiality, integrity, and availability per CVSS, with local access and no user...

CVE-2023-20676

CVE-2023-20676 is an out-of-bounds read vulnerability in the WLAN component of MediaTek devices (notably affecting Mediatek WLAN stacks such as MT5221 and similar chips). The underlying issue is a missing bounds check, enabling local information disclosure and, per the description, potentially al...

CVE-2023-20800

CVE-2023-20800 affects MediaTek imgsys. The vulnerability is a missing pointer check in the imgsys component that can cause a system crash and enable local escalation of privilege with system execution privileges required. Exploitation requires user interaction. A patch exists (Patch ID: ALPS0742...

CVE-2023-20836

CVE-2023-20836 affects the CAMSYS component. The vulnerability is an out-of-bounds read caused by a missing bounds check, which could lead to local information disclosure with System execution privileges; exploitation reportedly does not require user interaction. The documented patch reference is...

CVE-2023-21302

CVE-2023-21302 affects Android’s Package Manager. The issue is a side-channel information disclosure that lets an attacker determine whether an app is installed without query permissions, leading to local information disclosure without any execution privileges. Exploitation details are not provid...

CVE-2023-21327

CVE-2023-21327 relates to a side-channel information disclosure in Android’s Permission Manager, enabling an attacker to determine if an app is installed without query permissions. The vulnerability allows local information disclosure with no extra execution privileges and requires no user intera...

CVE-2023-21328

Technical details about CVE-2023-21328 (affected product/version, root cause, or fixes) are not publicly provided in the connected documents. Monitor for updates and future disclosures.

CVE-2023-21354

CVE-2023-21354 is associated with Android’s Package Manager Service. The described vulnerability allows an attacker to determine if an app is installed without query permissions via a side-channel information disclosure, enabling local information leakage without additional execution privileges. ...

CVE-2023-21397

CVE-2023-21397 is documented in Android 14 Framework as an elevation of privilege (EoP) vulnerability. The issue originates from the Setup Wizard where an insecure default value permits saving a Wi‑Fi network, enabling local privilege escalation with no additional execution privileges and no user...

CVE-2023-30926

CVE-2023-30926 affects the opm service: a missing permission check can permit local information disclosure without additional privileges. The CVSS vector indicates local attack with low complexity and low privileges required, affecting confidentiality (high) with no integrity/availability impact....

CVE-2023-32813

The CVE-2023-32813 issue affects the gnss service and involves an out-of-bounds write caused by improper input validation. This could lead to local information disclosure with system privileges required; no user interaction is needed. A patch is identified as ALPS08017370 (Issue ALPS08017370) and...

CVE-2023-42636

CVE-2023-42636 affects the validationtools component, where a missing permission check could allow local information disclosure without requiring additional privileges. Public documentation in connected sources ties this vulnerability to UNISOC chipsets context, but explicit exploitation details,...

CVE-2023-42655

CVE-2023-42655 relates to the sim service where there is a missing permission check that allows writing permission usage records, enabling local privilege escalation to System level. The advisory consistently references the sim service as the affected component and describes the root cause as ins...

CVE-2023-44123

The CVE-2023-44123 issue affects com.lge.bluetoothsetting and arises from using implicit PendingIntents with PendingIntent.FLAG_MUTABLE, enabling theft/over-write of arbitrary files with system privilege. An attacker’s app with access to notifications could intercept them, redirect to its activit...

CVE-2023-52346

A security vulnerability exists in UNISOC Chipsets (manufactured by Purple Spreadtrum ) due to improper validation of inputs in the modem driver . This flaw can lead to a system crash and potentially result in local information disclosure . Exploitation of this vulnerability requires System execu...

CVE-2024-20078

A security vulnerability exists in MediaTek chips within the venc component. The issue is caused by a type confusion error, which can lead to an out-of-bounds write . An attacker can exploit this vulnerability to achieve a local escalation of privilege . Exploitation does not require user interac...

CVE-2024-20099

MediaTek chips are affected by a security vulnerability in the power module caused by a missing bounds check. This flaw allows for a possible out-of-bounds write , which could lead to a local escalation of privilege . Exploitation requires System execution privileges and does not require user int...

CVE-2024-20152

A security vulnerability exists in the wlan STA driver of MediaTek Chipsets due to improper exception handling , which results in a possible reachable assertion. If a malicious actor has already obtained System privilege , they could trigger a local denial of service . No user interaction is requ...

CVE-2024-39434

CVE-2024-39434 concerns UNISOC chipsets where the drm service contains a missing bounds check that enables an out-of-bounds read. This is described as a local denial of service condition with system execution privileges required. The available connected sources consistently report the issue in th...

CVE-2026-0010

CVE-2026-0010 involves the IDrmManagerService.cpp onTransact function, where a missing bounds check allows an out-of-bounds write that could enable local escalation of privileges without user interaction. The vulnerability is reported across multiple feeds (Android-related CVE entry, Red Hat, CIR...

CVE-2026-0091

The Android Framework component is vulnerable to local privilege escalation due to over-privileged shell users in multiple locations. This flaw allows an attacker to execute code within the launcher process without requiring additional execution privileges or user interaction. While the specific ...

CVE-2026-28573

CVE-2026-28573 affects Android Wear OS via a Framework component vulnerability described as a local denial of service in AndroidManifest.xml due to a missing permission check. The CVE is characterized as high severity with a CVSSv4 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:I:H/CI:H/AI:H; impacts ...

CVE-2026-28576

In Android, the Contacts Provider is affected by CVE-2026-28576, caused by a SQL injection in the contacts database access path. This allows local information disclosure without extra execution privileges and without user interaction. The issue is described across CVE entries and ENISA/Android re...

CVE-2009-2999

The CVE-2009-2999 entry affects Android 1.5 CRBxx: remote attackers can cause a DoS (application restart and network disconnection) by sending a malformed WAP Push SMS, triggering an ArrayIndexOutOfBoundsException in com.android.phone. Connected sources confirm a Malformed SMS DoS with fixed vers...

CVE-2011-2343

Technical details about CVE-2011-2343 are not publicly provided in the connected documents. Monitor for updates.

CVE-2014-7953

CVE-2014-7953 describes a race condition in Android 4.4.4’s ActivityManagerService.bindBackupAgent that lets a local user with adb shell execute code as system by coordinating an adb install with a crafted logcat script to force bindBackupAgent to use an ApplicationInfo uid of 1000. The flaw stem...

CVE-2014-9882

CVE-2014-9882 is a buffer overflow in drivers/media/radio/radio-iris.c within the Qualcomm component used on Android devices (notably Nexus 7 2013). Exploitation via a crafted application could allow an attacker to gain privileges on the device. Multiple connected sources corroborate this issue a...

CVE-2015-3823

CVE-2015-3823 concerns libstagefright in Android versions before 5.1.1 LMY48T. A crafted media file can cause memory corruption in mediaserver, enabling remote code execution or a denial of service. The NVD description notes remote code execution and memory corruption via specially crafted files ...

CVE-2015-6632

CVE-2015-6632 affects libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allowing remote attackers to obtain sensitive information and potentially bypass a protection mechanism by obtaining Signature or SignatureOrSystem access via unknown vectors. The issue is documented in...

CVE-2015-6633

The CVE-2015-6633 entry describes a memory corruption vulnerability in Android display drivers that can enable remote code execution or a denial of service when processing specially crafted media files. Affected products are Android versions prior to 5.1.1 LMY48Z and Android 6.0 prior to 2015-12-...

CVE-2015-8506

The CVE-2015-8506 entry concerns Android mediaserver memory corruption via a crafted media file, allowing remote code execution or denial of service. Affected software: Android mediaserver prior to 5.1.1 LMY48Z and 6.0 prior to 2015-12-01. Root cause: memory corruption triggered by crafted media ...

CVE-2015-8593

CVE-2015-8593 describes a buffer overflow in the 1x call processing of Qualcomm components used in Android CAF releases running the Linux kernel. The entry indicates a high-severity issue (CVSSv3: 9.8, CRITICAL) with network access, no user interaction, and no privileges required, potentially imp...