CVE-2022-47362

CVE-2022-47362 affects telecom service with a missing permission check, enabling local denial of service. Documented in multiple feeds (NVD/Red Hat/PRION/Gov sources) reports: local exploit possibility; exploitation status not detailed. Some references indicate no disclosed fix version; PT-Securi...

CVE-2022-47465

CVE-2022-47465 affects the vdsp service, where a missing permission check can cause local denial of service. The CVE description and multiple sources confirm a local, low-privilege issue with no required user interaction, resulting in availability impact. Exploitation details are not provided in ...

CVE-2022-48242

CVE-2022-48242 concerns the telephony service in UNISOC chipsets where a missing permission check can lead to local information disclosure without requiring additional execution privileges. The linked documents consistently describe a local-privilege-check failure in the telephony service module,...

CVE-2023-20605

CVE-2023-20605 describes an out-of-bounds read in MediaTek keyinstall caused by a missing bounds check, potentially enabling local information disclosure with SYSTEM privileges and no user interaction. The advisory notes a patch (Patch ID: ALPS07550104; Issue ID: ALPS07550104). Exploitation detai...

CVE-2023-20632

CVE-2023-20632 affects the usb module in MediaTek hardware/software, causing an out-of-bounds write due to a missing bounds check. The impact is local escalation of privileges with System execution privileges required; no user interaction is needed. A patch/mitigation is referenced as Patch ID AL...

CVE-2023-20682

CVE-2023-20682 affects the MediaTek wlan component, describing an out-of-bounds write caused by an integer overflow that could enable local privilege escalation with system execution privileges required. User interaction is not needed. A patch is noted: ALPS07441605 (Issue ALPS07441605). Connecte...

CVE-2023-20738

CVE-2023-20738 affects the vcu component in MediaTek chips, caused by a missing bounds check that permits an out-of-bounds write. The vulnerability can lead to local escalation of privilege with SYSTEM-level execution, and exploitation does not require user interaction. Public references consiste...

CVE-2023-20809

CVE-2023-20809 concerns MediaTek’s vdec component, where a missing bounds check enables an out-of-bounds write. This can lead to local privilege escalation with system privileges, and exploitation does not require user interaction. The advisory notes a patch: DTV03751198 (Issue ID: DTV03751198). ...

CVE-2023-20812

CVE-2023-20812 affects the WLAN driver via an out-of-bounds write caused by improper input validation. Impact described as local information disclosure with potential System privileges required; no user interaction needed for exploitation. Patch ALPS07944987 (Issue ID ALPS07944987) referenced in ...

CVE-2023-20836

CVE-2023-20836 affects the CAMSYS component. The vulnerability is an out-of-bounds read caused by a missing bounds check, which could lead to local information disclosure with System execution privileges; exploitation reportedly does not require user interaction. The documented patch reference is...

CVE-2023-21302

CVE-2023-21302 affects Android’s Package Manager. The issue is a side-channel information disclosure that lets an attacker determine whether an app is installed without query permissions, leading to local information disclosure without any execution privileges. Exploitation details are not provid...

CVE-2023-21347

CVE-2023-21347 is a Bluetooth information-disclosure vulnerability caused by a missing bounds check that enables a remote read of memory without user interaction. The initial and related records consistently describe an out-of-bounds read leading to potential information disclosure with no extra ...

CVE-2023-21354

CVE-2023-21354 is associated with Android’s Package Manager Service. The described vulnerability allows an attacker to determine if an app is installed without query permissions via a side-channel information disclosure, enabling local information leakage without additional execution privileges. ...

CVE-2023-32813

The CVE-2023-32813 issue affects the gnss service and involves an out-of-bounds write caused by improper input validation. This could lead to local information disclosure with system privileges required; no user interaction is needed. A patch is identified as ALPS08017370 (Issue ALPS08017370) and...

CVE-2023-42636

CVE-2023-42636 affects the validationtools component, where a missing permission check could allow local information disclosure without requiring additional privileges. Public documentation in connected sources ties this vulnerability to UNISOC chipsets context, but explicit exploitation details,...

CVE-2023-42641

CVE-2023-42641 affects the component validationtools . The root cause, as described in the connected records, is a missing permission check that could lead to local information disclosure without any additional execution privileges. The issue is consistently reported across multiple sources (NVD,...

CVE-2023-44123

The CVE-2023-44123 issue affects com.lge.bluetoothsetting and arises from using implicit PendingIntents with PendingIntent.FLAG_MUTABLE, enabling theft/over-write of arbitrary files with system privilege. An attacker’s app with access to notifications could intercept them, redirect to its activit...

CVE-2024-20078

CVE-2024-20078 affects the venc component. The issue is a type-confusion–driven out-of-bounds write that can cause local escalation to System privileges; exploitation requires no user interaction. Remediation exists as Patch ID ALPS08737250 (MSV-1452). Several sources (NVD, Red Hat, CVE listings,...

CVE-2026-0055

CVE-2026-0055 describes a path traversal in PackageInstallerService.java (createSessionInternal) that could let an attacker place or move a Device Policy Controller (DPC) into an invalid directory, enabling local privilege escalation without extra execution privileges or user interaction. The det...

CVE-2014-9783

The CVE-2014-9783 entry affects the Qualcomm component in Android on Nexus 7 (2013) devices, specifically the drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c. The root cause is that the code path does not validate certain values, enabling a local attacker with a crafted application to g...

CVE-2014-9886

CVE-2014-9886 affects Android on Nexus 5 and Nexus 7 (2013) devices, specifically the Qualcomm component under arch/arm/mach-msm/qdsp6v2/ultrasound/usf.c. The vulnerability is caused by improper validation of input parameters in USF, enabling a local attacker to gain privileges via a crafted appl...

CVE-2014-9936

CVE-2014-9936 describes a time-of-check time-of-use race condition in TrustZone used during authentication on Android devices that use CAF/Linux kernel. Connected sources indicate the issue affects Android releases prior to 7.0 in TrustZone authentication routines, implying a potential impact to ...

CVE-2014-9972

CVE-2014-9972 affects Qualcomm products used in Android devices that run CAF Android builds with the Linux kernel. The issue arises when assertions are disabled, which can lead to a NULL pointer dereference during an out-of-memory condition. The description in the provided documents attributes th...

CVE-2015-1536

CVE-2015-1536 is an integer overflow in Bitmap_createFromParcel() in Android’s core/jni/android/graphics/Bitmap.cpp, affecting Android versions prior to 5.1.1 (LMY48I). The flaw arises from improper bitmap unmarshalling and can allow a crafted application to crash the system_server (denial of ser...

CVE-2015-3877

CVE-2015-3877 concerns Skia used in Android before 5.1.1 LMY48T. A vulnerability in libskia/media processing can allow a remote attacker to cause memory corruption, enabling remote code execution or a denial of service via a specially crafted media file. The issue is described as a remote-code-ex...

CVE-2015-6612

CVE-2015-6612 affects libmedia in Android prior to 5.1.1 LMY48X and 6.0 prior to 2015-11-01. The issue is an elevation of privilege via a crafted app that can execute code in mediaserver’s context (via libmedia). Affected Android builds include Nexus devices patched with Build LMY48X or later and...

CVE-2015-8999

CVE-2015-8999: The vulnerability is described as a TrustZone buffer overflow that can occur in Android CAF builds when loading an ELF file. Connected sources corroborate a TrustZone buffer overflow in Android’s TrustZone component with potential for arbitrary code execution or denial of service, ...

CVE-2015-9009

CVE-2015-9009 is an Elevation of Privilege vulnerability in Qualcomm closed‑source components exposed via Android kernel. The public data indicates the issue affects Qualcomm/Android architectures and is classified as Critical (CVSS v3 9.8). The CVE is listed under Qualcomm closed‑source componen...

CVE-2016-0848

CVE-2016-0848 is a race-condition vulnerability in Android’s Download Manager that affects Android 4.x (before 4.4.4), 5.x (before 5.0.2 or 5.1.1), and 6.x (before 2016-04-01). A crafted app can exploit a symlink target change to bypass private-storage file-access restrictions, enabling unauthori...

CVE-2016-10336

Technical details about CVE-2016-10336 are not publicly available in the provided connected documents. The material confirms memory regions unprotected during boot on CAF Android/Linux, but remediation specifics are not included here. Monitor for updates.

CVE-2016-10342

CVE-2016-10342 is a buffer overflow in an Android CAF Linux kernel syscall handler. Attack requires local access and user interaction, with potential for high impact (admin privileges) per CVSS data. Affected: Android CAF builds using the Linux kernel; exploit details are not provided in the link...

CVE-2016-11039

CVE-2016-11039 affects Samsung mobile devices running KK/4.4, L/5.0–5.1, and M/6.0 (AP + CP MDM9x35 or Qualcomm Onechip). The issue is a NULL pointer dereference in the IPC socket code, as described by multiple sources (e.g., Red Hat and NVD records). Impact is indicated as HIGH with potential av...

CVE-2016-2458

The CVE-2016-2458 issue affects AOSP Mail: the compose functionality in Android 5.0.x (pre-5.0.2), 5.1.x (pre-5.1.1), and 6.x (pre-2016-05-01) does not adequately restrict attachments, enabling information disclosure via a crafted app related to ComposeActivity.java and ComposeActivityEmail.java....

CVE-2016-3741

CVE-2016-3741 affects the H.264 decoder in mediaserver on Android 6.x (prior to 2016-07-01). The issue arises because certain slice data is not initialized, enabling remote attackers to execute arbitrary code or cause a memory corruption leading to a denial of service. The vulnerability impact is...

CVE-2016-6772

CVE-2016-6772 is an Android Wi‑Fi elevation of privilege vulnerability. The issue could let a local malicious app execute code in the context of a privileged Wi‑Fi process. Affected products/versions per the entry: Android 5.0.2, 5.1.1, 6.0, 6.0.1, and 7.0. The root cause is exploitation of the W...

CVE-2017-0397

CVE-2017-0397 is an information-disclosure vulnerability in Android’s Mediaserver component, specifically in id3/ID3.cpp within libstagefright. The issue could allow a local malicious app to access data outside its permission levels. Affected products/versions include Android releases 4.4.4–7.1.1...

CVE-2017-0409

CVE-2017-0409 is a remote code execution vulnerability in Android’s libstagefright. The connected documents confirm the affected component (libstagefright) and that exploitation involves processing a specially crafted file to run code in the context of an unprivileged process, with Android versio...

CVE-2017-0416

CVE-2017-0416 affects Android: an elevation of privilege in the Audioserver could allow a local malicious app to execute arbitrary code in the context of a privileged process. Affected software is Android, with versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1. The description documents th...

CVE-2017-0442

CVE-2017-0442 describes an elevation-of-privilege in the Qualcomm Wi‑Fi driver on Android, allowing a local malicious app to execute arbitrary code in the kernel context. The vulnerability, affecting Android devices with Qualcomm Wi‑Fi components, is mitigated by requiring compromise of a privile...

CVE-2017-0478

CVE-2017-0478 describes a remote code execution in the Android Framesequence library. A crafted file could cause an unprivileged process to execute arbitrary code within the attacker’s control. Affected Android versions include 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1. The available sources confi...

CVE-2017-0602

CVE-2017-0602 describes an information-disclosure vulnerability in Bluetooth on Android that could let a local malicious app bypass OS protections that isolate app data. Affected versions span Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The vulnerability is categorized as Mode...

CVE-2017-0703

The CVE-2017-0703 entry describes an Elevation of Privilege vulnerability in Android System UI affecting Android 4.4.4 through 7.1.2. Root cause: a flaw in System UI that could allow a local attacker to escalate privileges. Impact as documented: HIGH for confidentiality, integrity, and availabili...

CVE-2017-0767

CVE-2017-0767 is an Elevation of Privilege vulnerability in Android’s media framework (libeffects) affecting Android versions 4.4.4 through 7.1.2. The issue is described as an EoP in the media stack, enabling a local attacker to execute code with elevated privileges within a privileged process. T...

CVE-2017-0784

CVE-2017-0784 is an elevation of privilege in the Android NFC subsystem. Affected product: Android (versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2). The provided documents identify the issue as an Android NFC privilege escalation but do not specify the root cause, impacted component beyond ...

CVE-2017-0799

CVE-2017-0799 is a MediaTek-related elevation-of-privilege vulnerability affecting the MediaTek lastbus within the Android kernel. The issue is described as an EoP in the lastbus component, enabling a local attacker to potentially gain higher privileges. The vulnerability is associated with Media...

CVE-2017-0810

CVE-2017-0810 describes a remote code execution vulnerability in Android’s media framework (libmpeg2). Affected products/versions include Android 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0. The root cause is a flaw in the libmpeg2 component within the Android Media framework that could allow arbitrar...

CVE-2017-0817

CVE-2017-0817 is an information-disclosure vulnerability in the Android media framework (libstagefright). Affected products/versions, per sources, include Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0 (Android ID A-63522430). The NVD CVSS data indicate a network-exposed issu...

CVE-2017-0818

The CVE-2017-0818 entry concerns the Android Media Framework vulnerability affecting Android 7.0, 7.1.1, 7.1.2 and 8.0. The issue is described as a vulnerability in the Android media framework (component: Media Framework) with no explicit root-cause details in the provided docs. CVSSv3 base score...

CVE-2017-0827

CVE-2017-0827 is an Elevation of Privilege vulnerability in the MediaTek SoC driver within the Android kernel. Affects Android devices with MediaTek SoC driver stack; root cause is a flaw in the SoC driver that could allow a local attacker to execute arbitrary code within a privileged process con...

CVE-2017-0845

CVE-2017-0845 is a denial-of-service vulnerability in the Android framework’s syncstorageengine. The issue affects Android devices running versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The vulnerability is categorized as DoS with network attack vector and authorship requires no user i...