CVE-2023-42641

CVE-2023-42641 affects the component validationtools . The root cause, as described in the connected records, is a missing permission check that could lead to local information disclosure without any additional execution privileges. The issue is consistently reported across multiple sources (NVD,...

CVE-2022-20332

CVE-2022-20332 affects Android 13 and involves the PackageManager. The issue allows an app to infer whether another app is installed via a side-channel information disclosure, resulting in local information disclosure without extra execution privileges. Exploitation is described as local with no ...

CVE-2022-26432

CVE-2022-26432 affects MediaTek-based devices where a mailbox out-of-bounds write due to a missing bounds check can enable local privilege escalation with System privileges. Public details consistently describe the issue without user interaction; no exploit details are provided in the documents. ...

CVE-2022-26470

The CVE-2022-26470 issue affects the aie module in MediaTek chips. It is an out-of-bounds write caused by an incorrect bounds check, enabling local privilege escalation to System level with no user interaction required. A patch is identified as ALPS07116037 (Issue ALPS07116037).

CVE-2022-32607

CVE-2022-32607 affects the aee component in MediaTek-derived implementations. The root cause is a use-after-free caused by a missing bounds check, enabling local escalation to System privileges without user interaction. The vulnerability is described with a local attack vector and high impact on ...

CVE-2022-32608

CVE-2022-32608 describes a race-condition–driven use-after-free in the jpeg component that can allow local escalation of privilege to SYSTEM. Exploitation is possible without user interaction, with local access required. Reported patch/identifier: ALPS07388753 (Issue ID: ALPS07388753). Connected ...

CVE-2022-32653

The CVE-2022-32653 issue affects MediaTek’s mtk-aie, described as a use-after-free caused by a logic error that could allow local escalation of privilege with system execution privileges needed, no user interaction required. Multiple connected sources (Red Hat, CVE listings, PRION, CNNVD, PT-Secu...

CVE-2022-38671

The CVE-2022-38671 entry concerns a vulnerability in the UNISOC camera driver where a missing bounds check enables an out-of-bounds write, potentially causing a local denial of service in the kernel. The NVD description confirms the issue as an out-of-bounds write in the camera driver with local ...

CVE-2022-38674

The CVE-2022-38674 entry concerns a vulnerability in the wlan driver where a missing parameters check can allow a local denial of service against wlan services. Affected component: wlan driver (and associated Qualcomm wlan context in several records). Root cause: insufficient input/parameter vali...

CVE-2022-39100

CVE-2022-39100: A missing permission check in the power management service is described across multiple sources (notably UNISOC chipset context). Affected component is the power management service; root cause is improper authorization, allowing setup with no additional execution privileges. Impac...

CVE-2022-39880

CVE-2022-39880 affects DualOutFocusViewer prior to Samsung SMR Nov-2022 Release 1. Root cause: improper input validation leading to local arbitrary code execution. Impact (per sources): local attacker can execute code with affected privileges; CVSSv3.1 base score 7.8 (HIGH) with LOCAL access, LOW...

CVE-2022-42763

The CVE-2022-42763 issue affects the wlan driver and is caused by a missing bounds check in the wireless subsystem. The exposed vulnerability could allow local denial of service to wlan services. Documented descriptions consistently identify the wlan driver as the vulnerable component and cite th...

CVE-2022-42773

The CVE-2022-42773 issue concerns the WLAN driver (multiple references cite the same description) with a missing bounds check in the WLAN driver, leading to local denial of service of WLAN services. Affected context appears to involve UNISOC chipset WLAN drivers; specific product/version details ...

CVE-2022-42774

CVE-2022-42774 corresponds to a local denial-of-service vulnerability in the wlan driver caused by a missing bounds check in the wlan path. Connected sources confirm the issue affects the wlan driver and can lead to DoS of wlan services via local access. The Red Hat advisory and other feeds reite...

CVE-2022-42777

CVE-2022-42777 concerns a missing permission check in the power management service, enabling setup of the service with no additional execution privileges. The issue is described as local attack vector with low attack complexity, requiring low privileges and no user interaction, and it is assessed...

CVE-2022-44446

CVE-2022-44446 affects the WLAN driver, with the root cause described as a missing bounds check in the wlan driver. The practical impact stated across sources is a local denial of service in WLAN services. No exploit details, affected product versions, or remediation steps are provided in the con...

CVE-2022-47346

In CVE-2022-47346, the issue affects engineermode services where a missing permission check enables local denial of service. The CVE is described as a local vulnerability with a DoS impact, relying on local access to trigger the flaw. The provided metrics indicate a local attack vector with low c...

CVE-2022-47355

CVE-2022-47355 is described across multiple sources as a missing permission check in a log service that could allow local denial of service. The primary affected component appears to be the log service, with the root cause stated as insufficient permission validation. Reported impact is local den...

CVE-2022-47371

The CVE-2022-47371 issue affects the bt driver (kernel component). A thread competition causes resources to be released early, which can enable local denial of service in the kernel. Documents consistently describe the vulnerability and impact as local DoS but do not provide confirmed exploit det...

CVE-2022-47450

CVE-2022-47450 concerns the WLAN driver where a missing permission check could allow local information disclosure. Multiple sources (NVD entry, RH advisories, PRION, CNNVD, CVE lists) describe the issue as a local-privilege-context exposure with high confidentiality impact and no explicit exploit...

CVE-2022-47464

CVE-2022-47464 describes a missing permission check in the telecom service, enabling local denial of service. Affected: telecom service component; root cause: insufficient permission validation. Impact: local DoS with high availability impact as per CVSS 3.1 vector. Exploitation details are not p...

CVE-2022-47473

CVE-2022-47473 affects the telephony service (telephony module) where a missing permission check can lead to local information disclosure without requiring additional privileges. Multiple sources (Red Hat, NVD, CVE List, and UNISOC/CNNVD summaries) describe the same root cause and impact, with th...

CVE-2022-47483

The CVE-2022-47483 entry describes a missing permission check in the telephony service, enabling local denial of service with no additional privileges. Connected documents reaffirm this issue across multiple sources (e.g., Red Hat, NVD, PRION, CNNVD) but do not provide product/vendor/version or a...

CVE-2022-48376

CVE-2022-48376 affects UNISOC chipsets’ dialer service module. The root cause is a missing permission check, which could allow a local attacker to trigger a denial of service without gaining additional execution privileges. The CVE is documented with a CVSS v3.1 base score of 5.5 (Local attack, L...

CVE-2022-48377

CVE-2022-48377 concerns a vulnerability in the dialer service, where a missing permission check could allow a local denial of service without requiring additional privileges. Affected software appears tied to Unisoc/Unisoc-dialer components referenced across multiple records, but no precise produ...

CVE-2023-20608

The CVE-2023-20608 issue concerns MediaTek chip display DRM and is caused by a race condition leading to a use-after-free, enabling local privilege escalation with SYSTEM privileges. Affected component is the display DRM path; impact is local escalation of privileges (no user interaction required...

CVE-2023-20640

The CVE-2023-20640 entry concerns the ril module in MediaTek chips, with a root cause of an out-of-bounds write due to a missing bounds check. This could enable local escalation of privilege to SYSTEM level without user interaction. The vulnerability details indicate a high-impact, local attack v...

CVE-2023-20650

The CVE-2023-20650 entry describes a vulnerability in MediaTek chips’ apu module: an out-of-bounds write from a missing bounds check, enabling local escalation of privilege to System level. No exploitation details are provided in the documents. CVSSv3.1/3.1 base score 6.7 (MEDIUM); attack vector ...

CVE-2023-20673

The CVE-2023-20673 entry describes a memory corruption via type confusion in the vcu module of MediaTek chips, enabling local escalation of privileges with System execution privileges required. Impact is high for confidentiality, integrity, and availability per CVSS, with local access and no user...

CVE-2023-20735

CVE-2023-20735 concerns the vcu component in MediaTek chips, where a missing bounds check can cause an out-of-bounds write. The under-lying flaw is a lack of boundary verification in vcu, potentially enabling local escalation of privilege with System-level execution privileges required. Exploitat...

CVE-2023-20804

In imgsys, there is a reported out-of-bounds write due to a missing bounds check, leading to local escalation of privilege with System execution privileges required and no user interaction. The entry lists Patch ID ALPS07199773 and Issue ID ALPS07326384 as remediation details. Exploitation status...

CVE-2023-20833

The CVE-2023-20833 issue concerns MediaTek devices featuring the keyinstall component. A missing bounds check in keyinstall is reported to cause local information disclosure, with the prerequisite that system execution privileges are required and no user interaction is needed for exploitation. Th...

CVE-2023-21229

CVE-2023-21229 concerns Google Wear OS (Framework/ManagedServices.java: registerServiceLocked) where an unsafe PendingIntent can bypass background activity launch restrictions. This vulnerability enables local escalation of privilege with no additional privileges and no user interaction required,...

CVE-2023-21306

CVE-2023-21306 affects Android’s ContentService, enabling local information disclosure by reading installed sync content providers via a side-channel. The vulnerability description states no additional execution privileges and no user interaction are required. The available sources (CVE entry and...

CVE-2023-21328

Technical details about CVE-2023-21328 (affected product/version, root cause, or fixes) are not publicly provided in the connected documents. Monitor for updates and future disclosures.

CVE-2023-21381

CVE-2023-21381 is an Android vulnerability reported across multiple sources, with concrete details indicating a local use-after-free in the Media Resource Manager that enables possible local arbitrary code execution and local escalation of privilege without user interaction. The Android 14 releas...

CVE-2023-32823

The CVE-2023-32823 entry describes a memory corruption issue in the rpmb module (MediaTek). The root cause is a missing bounds check that can lead to local privilege escalation with System-level execution privileges required; no user interaction is needed. Affected component: rpmb (MediaTek devic...

CVE-2023-32826

CVE-2023-32826 concerns a vulnerability in camera middleware where missing input validation can cause an out-of-bounds write, enabling local escalation of privilege with System execution privileges required. The issue is described consistently across sources (NVD/Red Hat PRION/CNNVD, etc.). No us...

CVE-2023-32827

CVE-2023-32827 concerns the camera middleware in MediaTek devices, where a missing input validation can cause an out-of-bounds write. The vulnerability enables local escalation of privilege with System-level execution privileges; exploitation is reported as not requiring user interaction. Public ...

CVE-2023-32884

In netdagent, the vulnerability is an information disclosure caused by an incorrect bounds check, enabling local escalation of privilege with System-level execution privileges. Affected component: netdagent (no specific versions provided in the connected docs). Impact is described as high for con...

CVE-2023-40633

CVE-2023-40633 describes a vulnerability in the phasecheckserver where a missing permission check could allow local information disclosure without requiring additional execution privileges. Supported by multiple sources (NVD entry, CVE records, and related enrichments), the flaw is characterized ...

CVE-2023-44121

CVE-2023-44121 describes an intent redirection in LG ThinQ Service (com.lge.lms2), specifically in NotificationManager.java, exploitable by a third‑party app via a broadcast with action com.lge.lms.things.notification.ACTION. The vulnerability is dangerous because LG ThinQ Service is a system app...

CVE-2023-45780

CVE-2023-45780 affects the Android Print Service. The issue stems from a logic error enabling a background activity launch, potentially causing local privilege escalation with no extra execution privileges required beyond user interaction. Documented impact covers confidentiality, integrity, and ...

CVE-2023-52344

CVE-2023-52344 affects UNISOC’s modem-ps-nas-ngmm. The issue is an undefined behavior caused by incorrect error handling in the module, potentially enabling remote information disclosure over a network with no additional execution privileges required. CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/...

CVE-2023-52534

This CVE concerns the ngmm component. The root cause is incorrect error handling that can lead to undefined behavior, resulting in remote denial of service. Affected software is ngmm; the exact versions are not specified in the provided documents. Impact is limited to availability (DoS) with no u...

CVE-2024-20086

CVE-2024-20086 concerns MediaTek vdec component where a missing bounds check can lead to an out-of-bounds write. This could enable local escalation of privilege with system execution privileges, and exploitation does not require user interaction. Public references indicate a patch ID: ALPS0893291...

CVE-2024-39438

The CVE-2024-39438 issue affects the linkturbonative service, caused by improper input validation that enables command injection. Exploitation could grant local escalation to SYSTEM-equivalent privileges. Connected sources (PT-2024-28497, NVD/ CVE records, Red Hat advisory) confirm the vulnerabil...

CVE-2025-31712

CVE-2025-31712 affects the cplog service due to a missing bounds check that enables an out-of-bounds write. This leads to local denial of service with no additional execution privileges required. The public documents do not provide exploitation details, affected versions, or remediation/patch inf...

CVE-2025-48533

CVE-2025-48533 affects the Android Framework. A race condition in the lockscreen context menu can be exploited to perform local escalation of privilege by using apps linked from the context menu, without additional execution privileges or user interaction. The vulnerability is characterized as Eo...

CVE-2026-0034

CVE-2026-0034 affects Android, arising from improper input validation in setPackageOrComponentEnabled within ManagedServices.java, causing a possible notification policy desync and local privilege elevation with no extra execution privileges or user interaction required. The issue is described ac...