CVE-2019-20772

CVE-2019-20772 affects LG mobile devices running Android 7.0–9.0 where the Account subsystem permits an authorization bypass. The vendor-specific LG advisory (LVE-SMP-190007) and Red Hat/NVD entries corroborate the same description. Root cause and exact vulnerable component are not detailed in th...

CVE-2019-20774

CVE-2019-20774 affects LG mobile devices running Android 7.x–9.0. A system service allows local retrieval of the user’s password, creating a local-confidentiality risk. The vulnerability has been documented under LG ID LVE-SMP-190009 (August 2019). Connected sources corroborate the issue without ...

CVE-2019-20783

CVE-2019-20783 affects LG mobile devices running Android 7.0–8.1 (North America CDMA). The issue is in the LTE protocol implementation, which allows a bypass of Authentication and Key Agreement (AKA). The available records (NVD, Red Hat advisory, CVE listings) describe the vulnerability and its L...

CVE-2019-2079

CVE-2019-2079 affects Android 10 via the libxaac library, where an out-of-bounds read due to a missing bounds check could lead to information disclosure. The vulnerability targets a library/file within the Android stack and is exploitable with user interaction; no explicit remote code execution i...

CVE-2019-2116

CVE-2019-2116 affects Android: a possible out-of-bounds read in save_attr_seq of sdp_discovery.cc could lead to remote information disclosure without user interaction. Documented impact is information disclosure (confidentiality) with no execution privileges required. Affected Android versions in...

CVE-2019-2142

The CVE-2019-2142 entry affects Android 10, specifically the libxaac library. The vulnerability is an information-disclosure flaw caused by a missing bounds check that could trigger an out-of-bounds read. Exploitation requires user interaction, and successful exploitation could disclose partial t...

CVE-2019-9469

CVE-2019-9469 affects the Android kernel Titan‑M component. A flaw in km_compute_shared_hmac (km4.c) allows an out‑of‑bounds write due to input validation issues, enabling local privilege escalation with no user interaction. CVSS data in NVD indicates LOCAL access, LOW attack complexity, with HIG...

CVE-2019-9472

CVE-2019-9472 describes a timing side-channel in DCRYPTO_equals (compare.c) in the Android kernel/Titan-M component, enabling local information disclosure without extra privileges and without user interaction. Public details across sources confirm the root cause as improper crypto usage, with dis...

CVE-2020-0104

CVE-2020-0104 affects Android 9 and 10, due to a logic error in KeyguardStateMonitor.java (onShowingStateChanged) that can disclose keyguard-protected data locally without extra privileges or user interaction. The issue is documented with a local-privilege/exposure impact (CVSS 3.1/5.5; CVSS2 bas...

CVE-2020-0109

CVE-2020-0109 affects Android 9–10 and relates to NotificationManagerService.java: in simulatePackageSuspendBroadcast there is a missing permission check, enabling local privilege escalation by crafting fake system notifications without extra execution privileges. Public references indicate the i...

CVE-2020-0113

CVE-2020-0113 is a Media framework information-disclosure vulnerability in Android 9–10. In Camera3OutputUtils.cpp, sendCaptureResult can trigger an out-of-bounds read due to a use-after-free, leading to local information disclosure without extra user interaction. Android bulletin 2020-06-01 clas...

CVE-2020-0115

CVE-2020-0115 is a local elevation-of-privilege vulnerability in Android’s PackageManagerService (verifyIntentFiltersIfNeeded) that could let a malicious app become the default handler for arbitrary domains, bypassing intended privileges with no user interaction. Affected: Android 8.0–8.1, 9, and...

CVE-2020-0190

CVE-2020-0190 affects Android 10 with a vulnerability in ideint_weave_blk of ideint_utils.c caused by a heap buffer overflow leading to an out-of-bounds write. This could enable remote code execution. Exploitation requires user interaction per the description. The Pixel security bulletin lists CV...

CVE-2020-0201

CVE-2020-0201 affects Android 10 with a vulnerability in WifiConfigController.java (showSecurityFields) that can leak credentials due to a confused deputy, enabling remote elevation of privilege without additional privileges or user interaction. The issue is documented in multiple sources; applic...

CVE-2020-13830

Technical details are not publicly available in the provided documents. Monitor for updates from official sources.

CVE-2021-0346

CVE-2021-0346 affects Android devices via the VPU component. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local escalation to System privileges without user interaction. Affected: Android 10 and Android 11 (VPU). Impact per sources indicates local privilege el...

CVE-2021-0366

In CVE-2021-0366, the vulnerability affects Android devices (Android-10 and Android-11) due to a memory corruption in the vpu caused by a race condition. This leads to local privilege escalation with System privileges required, and exploitation does not require user interaction. The vulnerability...

CVE-2021-0381

The CVE-2021-0381 issue affects Android 11 and is tied to DeviceStorageMonitorService.java (updateNotifications). It describes a possible permission bypass caused by an unsafe PendingIntent that can lead to local information disclosure without user interaction. The exploitable condition requires ...

CVE-2021-0492

The CVE-2021-0492 entry concerns Android’s memory management driver, where an out-of-bounds write due to a missing bounds check could enable local privilege escalation without user interaction. Concrete details across connected sources identify the affected component as the memory management driv...

CVE-2021-0663

CVE-2021-0663 describes an out-of-bounds write in the Mediatek audio DSP caused by an incorrect bounds check. Affects MediaTek DSP firmware across multiple MT chipsets and Android versions (9.0–11.0) with potential for local privilege escalation to System execution privileges, without user intera...

CVE-2021-0897

In CVE-2021-0897, the vulnerability affects the apusys component, where a missing bounds check allows an out-of-bounds write. This can lead to local privilege escalation with System execution privileges required and does not require user interaction. A patch is identified as ALPS05672107 (Issue A...

CVE-2021-25461

CVE-2021-25461 concerns a stack-based buffer overflow caused by an improper length check in APAService prior to Samsung SMR Sep-2021 Release 1. The vulnerability affects the APAService component and has documented impact in CVSS: CVSSv3.1 base score 7.8 (HIGH) with LOCAL attack vector, LOW attack...

CVE-2021-25476

CVE-2021-25476 describes an information-disclosure vulnerability in Widevine TA log prior to Samsung SMR Oct-2021 Release 1 that enables bypass of ASLR in the Trusted Execution Environment (TEE). Affected component: Widevine TA log. Root cause: information leakage in the log prior to the SMR patc...

CVE-2021-25485

CVE-2021-25485 corresponds to a path-traversal vulnerability in FactoryAirCommnadManger, exploitable via a Bluetooth remote socket to write files as the system UID. Affected firmware/product versioning is described as prior to Samsung SMR Oct-2021 Release 1. The connected sources consistently ide...

CVE-2021-25516

CVE-2021-25516 affects Samsung Exynos baseband (prior to SMR Dec-2021 Release 1). An improper handling of exceptional conditions in the baseband’s RRC MeasurementReport allows an attacker to track a device’s location. Impact is described as location-tracking with high practicality on affected Sam...

CVE-2021-3022

CVE-2021-3022 describes a lack of write protection for the MTK protect2 partition on LG mobile devices running Android 10 (LG ID LVE-SMP-200028). The issue is that protect2 could be written without protection, but exploitation details, affected models/versions beyond Android 10, and concrete reme...

CVE-2022-20012

CVE-2022-20012 affects the mdp driver and describes memory corruption caused by an integer overflow, enabling local privilege escalation without requiring user interaction. Multiple sources (NVD, Red Hat, CVE records) consistently cite the issue and a patch identified as ALPS05836478. The exploit...

CVE-2022-20270

CVE-2022-20270 affects Android 13, where a permissions bypass in the Content component could disclose the Gmail account name on a device with no extra privileges or user interaction. Documented impact is local information disclosure (confidentiality) with no exploitation details provided in the c...

CVE-2022-20274

In Android 13, CVE-2022-20274 affects the Keyguard component where a missing permission check could enable local escalation of privilege and prevent screen timeout. Exploitation requires local access with low privileges and no user interaction, potentially compromising confidentiality, integrity,...

CVE-2022-26453

The CVE-2022-26453 issue affects the MediaTek teei module. A memory corruption caused by use-after-free is the root cause. Consequences stated are local escalation of privilege with System execution privileges required, and exploitation does not require user interaction. A patch is referenced: AL...

CVE-2022-30724

CVE-2022-30724 (Samsung Mobile Bluetooth Information Disclosure) : The vulnerability arises from broadcasting the BluetoothDevice object in the sendIntentSessionCompleted function without properly restricting receivers, which leaks the MAC address of the connected Bluetooth device. This affects S...

CVE-2022-32605

CVE-2022-32605 affects MediaTek’s isp (MediaTek ISP) with an out-of-bounds write caused by an incorrect bounds check. This could allow local escalation to System privileges without user interaction. Patch: ALPS07213898 (Issue ALPS07213898) is referenced; exploitation status is not provided in the...

CVE-2022-32625

CVE-2022-32625 describes an out-of-bounds write caused by an incorrect bounds check in the display path, with potential local escalation to SYSTEM privileges and no user interaction required. Multiple connected sources reference MediaTek chips as affected and note the vulnerability’s impact on co...

CVE-2022-32643

CVE-2022-32643: In ccd, a race condition can cause a use-after-free, enabling local privilege escalation with SYSTEM privileges required and no user interaction. The vulnerability is described with Patch ID ALPS07341261/Issue ID ALPS07341261. Exploitation details are not provided in the connected...

CVE-2022-33696

The vulnerability CVE-2022-33696 affects Samsung Telephony service on Samsung mobile devices. It permits a local attacker to access sensitive mobile identifiers (IMSI and ICCID) through logs due to an information-disclosure flaw in the Telephony service, prior to the SMR July 2022 Release 1. Impa...

CVE-2022-33698

CVE-2022-33698 describes an information-disclosure vulnerability in Samsung’s Telecom application on Samsung mobile devices. The underlying issue allows local attackers to access the ICCID via logs, i.e., sensitive hardware identifiers are exposed by log handling within the Telecom app. Affected ...

CVE-2022-36846

CVE-2022-36846 is a heap-based overflow in the ConstructDictionary function of libSDKRecognitionText.spensdk.samsung.so, affecting versions prior to Samsung SMR Sep-2022 Release 1. The overflow can cause memory access faults (memory corruption). The issue is documented across multiple sources (NV...

CVE-2022-36848

In the connected PT-2022-23652 document, the issue is an Improper Authorization in the SoftwareX component tied to the setDualDARPolicyCmd function. Affects SoftwareX versions prior to SMR Sep-2022 Release 1; local attackers can cause a local permanent denial of service. Mitigation: update to SMR...

CVE-2022-36852

Video Editor on Samsung mobile devices is affected by an Improper Authorization vulnerability. The issue allows a local attacker to access internal application data due to improper authorization. Affected versions are prior to SMR Sep-2022 Release 1. Mitigation: update to SMR Sep-2022 Release 1 o...

CVE-2022-38687

CVE-2022-38687 describes a missing permission check in the messaging service, enabling local denial of service with no additional privileges. The available documents identify the affected component as the messaging service and note that the impact is local DoS; no exploitation details, affected p...

CVE-2022-39091

CVE-2022-39091 involves a missing permission check in the power management service. The root cause is insufficient authorization in the power management component, enabling setup of the service with no additional execution privileges required. Documented impact is a local attack surface with high...

CVE-2022-39111

CVE-2022-39111 describes a missing permission check in the Music service that can lead to elevation of privilege with no additional execution privileges required. The vulnerability is characterized as local, with low privileges required, and high impact to confidentiality, integrity, and availabi...

CVE-2022-39118

CVE-2022-39118 affects the sprd_sysdump driver, where a missing bounds check can lead to an out-of-bounds write and potentially local denial of service in the kernel. The primary sources consistently describe this issue as a local vulnerability with a MEDIUM severity (CVSS 3.1: AV:L/AC:L/PR:L/UI:...

CVE-2022-39121

CVE-2022-39121 describes an out-of-bounds write in a sensor driver caused by a missing bounds check, potentially allowing a local denial of service in the kernel. Connected sources reference Unisoc chipset implementations and related sensor-driver context; no explicit affected versions or fix are...

CVE-2022-39849

CVE-2022-39849 describes an improper access control in the knox_vpn_policy service prior to Samsung SMR Oct-2022 Release 1, allowing unauthorized read of configuration data. Affected component: knox_vpn_policy in Samsung Knox/VPN policy context. Root cause: insufficient access restrictions enabli...

CVE-2022-39853

CVE-2022-39853 describes a use-after-free vulnerability in the Samsung perf-mgr driver, affecting versions prior to the SMR Oct-2022 Release 1. The underlying issue allows an attacker to cause a memory access fault (memory corruption) and is classified with a high impact in NVD, with local attack...

CVE-2022-42757

CVE-2022-42757 affects the wlan driver (notably in UNISOC chipsets). The root cause is a missing bounds check in the wlan driver, which could lead to local denial of service in wlan services. Documented impacts across multiple sources indicate a local attack vector with low overall risk (CVSS 3.1...

CVE-2022-44445

CVE-2022-44445 affects the WLAN driver, where a missing bounds check in the driver could allow local denial of service in WLAN services. The CVSS vector indicates local access, low attack complexity, and required privileges with a high availability impact, resulting in a base score of 5.5 (Medium...

CVE-2022-47330

CVE-2022-47330 is described as a possible missing permission check in the WLAN driver causing local information disclosure. The connected documents reiterate this description but do not provide concrete technical details such as affected products, versions, root cause specifics, exploitation stat...

CVE-2022-47357

CVE-2022-47357 involves a missing permission check in the log service, enabling local denial of service. The CVSS 3.1 base score is 5.5 (LOCAL attacker, LOW attack complexity, LOW privileges required, HIGH impact on availability). The available documents do not specify the affected vendor/product...