CVE-2022-20047

CVE-2022-20047 affects MediaTek video decoder with a missing bounds check leading to an out-of-bounds write and local privilege escalation without user interaction. The issue is documented with patch ALPS05917489 (Issue ID: ALPS05917489). Connected sources also corroborate the vulnerability as a ...

CVE-2023-40127

CVE-2023-40127 is an Android information-disclosure issue affecting the MediaProvider component across multiple locations. It arises from a confused deputy scenario, allowing local information disclosure with no additional execution privileges and without user interaction. The NVD entry notes a l...

CVE-2021-39796

CVE-2021-39796 affects HarmfulAppWarningActivity in Android (HarmfulAppWarningActivity.java). It enables a tapjacking/overlay technique to trick a user into installing a harmful app, potentially causing local escalation of privilege with User execution privileges and requiring user interaction fo...

CVE-2023-20937

CVE-2023-20937 concerns memory corruption via a use-after-free in several functions of the Android Linux kernel, enabling local privilege escalation with no user interaction required. The vulnerability is described across multiple sources as affecting the Android kernel and related MM subsystems,...

CVE-2019-2097

CVE-2019-2097 affects Android systems via a memory corruption caused by type confusion in HAliasAnalyzer.Query (hydrogen-alias-analysis.h). This vulnerability could allow remote code execution from the context of a malicious proxy configuration without user interaction. Affected products/versions...

CVE-2021-0694

The CVE-2021-0694 entry concerns Android 11, where in ActiveServices.java (setServiceForegroundInnerLocked) a background app can regain foreground permissions due to insufficient background restrictions, leading to local elevation of privilege without requiring user interaction. The impact is ele...

CVE-2020-0230

CVE-2020-0230 is an Android-related issue described as an out-of-bounds write caused by an incorrect bounds check. The connected records identify the vulnerability as affecting the MediaTek vcu component in Android, with an Elevation of Privilege (EoP) impact classified as High. The Android bulle...

CVE-2022-20566

CVE-2022-20566 affects the Android kernel via a use-after-free in l2cap_core::l2cap_chan_put caused by improper locking, enabling local privilege escalation with no user interaction. Affected component is L2CAP handling in the Android kernel; upstream kernel mention confirms the underlying bug, a...

CVE-2023-20914

CVE-2023-20914 affects Android 11 in the Framework via onSetRuntimePermissionGrantStateByDeviceAdmin (AdminRestrictedPermissionsUtils.java). It enables a permissions bypass that could allow the work profile to read SMS messages, causing local information disclosure with low privileges and no user...

CVE-2019-2225

CVE-2019-2225 describes an elevation-of-privilege vulnerability in Android Bluetooth pairing where a malicious device could pair without user confirmation and interact with the phone, enabling remote privilege escalation without user interaction. The affected platform versions listed are Android ...

CVE-2021-0316

CVE-2021-0316 affects Android’s Bluetooth stack (AVRC) due to an out-of-bounds write in avrc_pars_vendor_cmd within avrc_pars_tg.cc caused by a missing bounds check. This leads to remote code execution over Bluetooth with no privileges and no user interaction required. Affected Android versions i...

CVE-2021-39694

CVE-2021-39694 affects Android 12 via a RoleParser.java issue that allows a default app to have user-denied permissions bypassed, enabling local escalation of privilege with no additional execution privileges and no user interaction required. Public exploitation details are not provided in the co...

CVE-2022-20009

CVE-2022-20009 refers to a vulnerability in the Android/Linux kernel USB gadget subsystem where a missing bounds check can cause an out-of-bounds write, enabling local privilege escalation with no required user interaction. The issue is described across multiple sources as affecting the Android k...

CVE-2022-20134

CVE-2022-20134 concerns a mitigation-resistant input validation flaw in Android’s UI flow. In readArguments of CallSubjectDialog.java, an improper validation allows an attacker to trick a user into dialing the wrong phone number, enabling local elevation of privilege with no additional execution ...

CVE-2022-20144

CVE-2022-20144 affects Android (AvatarPhotoController.java) on Android 10–11, where a confused deputy in multiple functions could allow access to content owned by system content providers. This could enable local escalation of privilege with no additional execution privileges and no user interact...

CVE-2022-20411

CVE-2022-20411 is an Android Bluetooth heap/bounds issue in avdt_msg_asmbl (avdt_msg.cc) where a missing bounds check enables an out-of-bounds write. This can lead to remote code execution over Bluetooth with no user interaction or privileges required. Affected: Android-10, Android-11, Android-12...

CVE-2023-20943

CVE-2023-20943 describes an elevation of privilege in Android via a path traversal in clearApplicationUserData within ActivityManagerService. The issue could allow removal of system files and local EoP with low privileges and no user interaction, affecting Android 10–13 (including 12/12L). The vu...

CVE-2023-40117

CVE-2023-40117 affects the Android SettingsProvider.java resetSettingsLocked path and describes a local privilege-escalation via a lockscreen bypass caused by a permissions bypass. The vulnerability enables elevation of privilege with LOCAL attack vector and LOW required privileges, without user ...

CVE-2024-43097

A security vulnerability exists in the SkRegion.cpp component of Google Android , Firefox ESR , and Thunderbird . The flaw is caused by an integer overflow in the resizeToAtLeast function, leading to an out-of-bounds write . This can result in local privilege escalation , allowing an attacker to ...

CVE-2021-39633

CVE-2021-39633 affects the Android/Linux kernel’s gre_handle_offloads path in ip_gre.c, where a memory access fault can cause a page fault and local information disclosure with no extra privileges or user interaction. Public details in connected Nessus advisories (Unity Linux UTSA advisories) con...

CVE-2022-20123

CVE-2022-20123 affects Android 10–12 (including 12L) via a missing bounds check in phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, causing an out-of-bounds read and potential remote information disclosure without user interaction. The issue is categorized in the Android Security Bulletin as a hi...

CVE-2022-20130

CVE-2022-20130 : In Android Media Framework, an out-of-bounds write due to a heap buffer overflow in transportDec_OutOfBandConfig (tpdec_lib.cpp) could enable remote code execution with no privileges or user interaction. Affected: Android 10–12–12L; patches released per the 2022-06 Android Bullet...

CVE-2023-21116

CVE-2023-21116 affects Android 11–13 and stems from a logic error in InstallPackageHelper.java, in verifyReplacingVersionCode, which could downgrade system apps below the system image version and enable local elevation of privilege with System privileges. Exploitation details are not provided in ...

CVE-2023-21267

The CVE-2023-21267 issue affects Android’s KeyguardViewMediator.java in the framework, enabling bypass of lockdown mode via screen pinning due to a logic error. This leads to local information disclosure without extra privileges or user interaction. Exploitation can occur on devices with access t...

CVE-2020-0225

CVE-2020-0225 affects Android 10 and is triggered by an out-of-bounds write in the function a2dp_vendor_ldac_decoder_decode_packet within a2dp_vendor_ldac_decoder.cc, caused by a missing bounds check. This leads to remote code execution with no privileges or user interaction required, as describe...

CVE-2020-0411

CVE-2020-0411 affects Android media framework (Media Framework) with an out-of-bounds write in AACExtractor.cpp due to uninitialized data, potentially enabling remote information disclosure. The Android 10/11 patch details in the 2020-10 bulletin list CVE-2020-0411 as an Information Disclosure is...

CVE-2022-20358

A missing permission check in the startSync method of AbstractThreadedSyncAdapter.java allows unauthorized access to protected content of content providers. This vulnerability affects Android versions Android-10 , Android-11 , Android-12 , and Android-12L . An attacker with User execution privile...

CVE-2024-0050

CVE-2024-0050 involves an out-of-bounds write in the getConfig path of SoftVideoDecoderOMXComponent.cpp. The issue is triggered via missing validation and results in a local, non‑security impact with no additional execution privileges required (no user interaction). Affected detail: the vulnerabi...

CVE-2019-2222

CVE-2019-2222 affects Android Media Framework, specifically the ihevcd_parse_slice_data path in ihevcd_parse_slice.c, where a missing bounds check can cause an out-of-bounds write. This could allow remote code execution in a privileged context, requiring user interaction to exploit. Affected Andr...

CVE-2019-9464

CVE-2019-9464 is a targeted Elevation of Privilege vulnerability in the Android Framework affecting Android 10, caused by an incorrect warning about an app accessing the user’s location in RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java. This could undermine ...

CVE-2020-0182

CVE-2020-0182 affects libexif, where exif_entry_get_value may perform an out-of-bounds read due to a missing bounds check, enabling local information disclosure without extra privileges. The published advisories and vendor bulletins (e.g., Red Hat RHSA-2020:4040; Debian DLA-2249-1; ALAS2-2020-152...

CVE-2021-39619

CVE-2021-39619 affects Android (Android 11 and 12) in the UsageStatsService.java updatePackageMappingsData path. The root cause enables bypassing security/privacy settings for app usage, permitting local escalation of privilege without extra execution privileges and without user interaction. Expl...

CVE-2022-23427

CVE-2022-23427 concerns a PendingIntent hijacking flaw in Samsung’s KnoxPrivacyNoticeReceiver. The vulnerability allows a local attacker to access media files via an implicit Intent prior to the SMR Feb-2022 Release 1. The descriptions across NVD, Red Hat, CNVD, CVE list, and related advisories a...

CVE-2023-21095

CVE-2023-21095 affects Android 12L and Android 13, in the canStartSystemGesture function of RecentsAnimationDeviceState.java. A race condition can cause a partial lockscreen bypass, enabling local privilege escalation without additional privileges or user interaction. Public references across mul...

CVE-2024-43762

Google Android contains a security vulnerability where a logic error in the code allows a service to avoid unbinding from the system in multiple locations. This flaw can be exploited by local attackers to submit special requests, resulting in a local escalation of privilege without requiring addi...

CVE-2021-39693

CVE-2021-39693 affects Android 12 via a logic error in AppOpsService.java (onUidStateChanged) that may allow access to location without a visible indicator, causing local privilege escalation with no extra execution privileges and no user interaction required. Connected sources confirm the issue ...

CVE-2024-23713

CVE-2024-23713 affects Google's Android Framework, specifically migrateNotificationFilter in NotificationManagerService.java. The root cause is improper input validation that can fail to persist notification settings, enabling local privilege escalation with no extra execution privileges required...

CVE-2019-2218

CVE-2019-2218 affects Android Framework (PackageInstallerService.java) with a missing permission check in createSessionInternal, enabling local elevation of privilege by installing malicious packages. Exploitation is local with no user interaction required and could grant complete confidentiality...

CVE-2019-9325

The CVE-2019-9325 issue affects the libvpx library (VP8/VP9 SDK) and is described as an out-of-bounds read caused by a missing bounds check. According to the provided documents, this could lead to remote information disclosure with no inherent execution privileges, and exploitation requires user ...

CVE-2021-39669

CVE-2021-39669 affects Android 11–12, in InstallCaCertificateWarning.java (onCreate). It enables a tapjacking/overlay flow to mislead users during CA certificate installation, leading to local elevation of privilege. Exploitation requires user interaction; no additional privileges are needed. Pat...

CVE-2022-20347

CVE-2022-20347 affects Android 10–12(12L) with a vulnerability in the onAttach path of ConnectedDeviceDashboardFragment.java that enables a permission bypass via a confused deputy, enabling remote escalation of privilege in Bluetooth settings without extra execution privileges or user interaction...

CVE-2026-0097

A logic error in multiple locations of the Android operating system allows an attacker to bypass user interaction when pairing an LE device . This vulnerability enables remote (proximal/adjacent) escalation of privilege without requiring additional execution privileges or user interaction. The is...

CVE-2017-0663

CVE-2017-0663: libxml2 remote code execution via a crafted file. The Android-impacting flaw is a libxml2 out-of-bounds write that can crash or enable code execution in an unprivileged process. Exploitation and impact are stated in the CVE entry, with high severity (CVSSv3 7.8). No public fix vers...

CVE-2019-2181

CVE-2019-2181 affects the Android/Linux kernel binder implementation (binder.c: binder_transaction), where an integer overflow can cause an out-of-bounds write. This enables local privilege escalation with no extra privileges; exploitation requires user interaction per the description. Public ref...

CVE-2019-2231

CVE-2019-2231 affects the Android blob handling in Blob::Blob (blob.cpp), where improper input validation can lead to an unencrypted master key and local information disclosure. The issue requires local access with system privileges to exploit, with no user interaction needed. Public sources conf...

CVE-2021-39702

CVE-2021-39702 affects Android 12; in onCreate of RequestManageCredentials.java, a tapjacking/overlay attack could allow a third‑party app to install certificates without user approval, enabling local elevation of privilege with User interaction required . Documented impact: EoP with high confide...

CVE-2022-20498

Technical details for CVE-2022-20498 are not provided in the connected documents. The initial description mentions an out-of-bounds read in fdt_ro.c causing local information disclosure, but lacks concrete product/version data or mitigations beyond the Android bulletin reference. Monitor for upda...

CVE-2022-20137

CVE-2022-20137 affects Android 12/Android 12L. The issue resides in NetworkProviderSettings.java onCreateContextMenu, where a missing permission check could allow a non-owner user to change WiFi settings, enabling local elevation of privilege. Exploitation requires user interaction, and the impac...

CVE-2022-20230

CVE-2022-20230 affects Android 10–12 (including 12L). In KeyChain.java, choosePrivateKeyAlias, improper input validation may allow access to the user’s certificate, enabling local information disclosure. Exploitation requires user interaction and does not grant additional execution privileges. Th...

CVE-2019-2221

CVE-2019-2221 affects Android 10, related to hasActivityInVisibleTask in WindowProcessController.hasActivityInVisibleTask. Root cause: incorrect handling of top activities in the INITIALIZING state, allowing bypass of user interaction requirements. Impact: local elevation of privilege (EoP) with ...