CVE-2016-0843

The CVE-2016-0843 issue affects the Qualcomm ARM processor performance-event manager used by Android. The vulnerability allows a locally executed, crafted application to elevate privileges to the kernel, described as an internal bug 25801197. Affected Android versions include 4.x prior to 4.4.4, ...

CVE-2016-0846

CVE-2016-0846 affects the IMemory Native Interface (libs/binder/IMemory.cpp) in Android, where the heap size is not properly accounted for, enabling a local attacker to gain privileged execution (Signature or SignatureOrSystem) via a crafted app. The issue affects Android 4.x up to 4.4.3/4.4.4, 5...

CVE-2023-32839

The CVE-2023-32839 entry describes a local out-of-bounds write in the dpe module caused by missing range checking, enabling local privilege escalation with SYSTEM rights and no user interaction. Affected: dpe (MediaTek-related context from multiple sources); impact is high for confidentiality, in...

CVE-2023-32876

CVE-2023-32876 involves the keyInstall function where a missing bounds check can cause information disclosure, requiring local privileges (PR:H) with no user interaction. Affected context appears to be media/SoC environments (MediaTek-related references appear across multiple connected sources), ...

CVE-2023-32881

CVE-2023-32881 affects MediaTek battery module. A possible information disclosure stems from an integer overflow, enabling local information disclosure with system-level privileges; no user interaction is required. Patch ALPS08308070 / ALPS08308080 is referenced. No exploit details or in-the-wild...

CVE-2023-33908

CVE-2023-33908 concerns a missing permission check in the ims service, associated with UNISOC chipsets. The vulnerability enables local information disclosure without requiring additional execution privileges. Reported by multiple sources (NVD/Red Hat/CVE entries) consistently describe the impact...

CVE-2023-33912

CVE-2023-33912 concerns the Contacts service in UNISOC-induced chipsets where a missing permission check could allow local information disclosure with no additional execution privileges. The available connected documents consistently state that the vulnerability enables local access to informatio...

CVE-2023-42635

Technical details about CVE-2023-42635 are not publicly provided in the supplied documents; monitor for updates.

CVE-2023-42648

CVE-2023-42648 affects UNISOC chipsets in engineermode, where a missing permission check can lead to local information disclosure without requiring elevated privileges. The available connected documents confirm the root cause (in engineermode) and the potential impact (local information disclosur...

CVE-2024-20088

CVE-2024-20088 affects MediaTek keyinstall: an out-of-bounds read due to a missing bounds check, enabling local information disclosure with system privileges. Public exploitation details are not provided in the available documents. The vulnerability is associated with patch ID ALPS08932099 and Is...

CVE-2024-20124

A security vulnerability exists in vdec (MediaTek Chipsets) caused by an improper structure design . This flaw allows for an out-of-bounds read , which could lead to local information disclosure . Exploitation requires System execution privileges and does not require user interaction. While Patch...

CVE-2026-0162

A type confusion vulnerability exists in the ParsePayloads function of AudioSdpParser.cpp, leading to potential memory corruption . This flaw could enable remote code execution without requiring additional privileges or user interaction. The issue specifically affects the IP Multimedia Subsystem ...

CVE-2014-7920

CVE-2014-7920 affects the Android mediaserver component. The entry describes a privilege-escalation flaw in mediaserver present on Android 2.2–5.x up to before 5.1, enabling attackers to gain privileges. The documents do not specify the exact root cause or exploit details, and no remediation/patc...

CVE-2014-9873

CVE-2014-9873 describes an integer underflow in Qualcomm components, specifically in drivers/char/diag/diag_dci.c, affecting Android on Nexus 5 and Nexus 7 (2013) devices prior to 2016-08-05. The flaw allows a crafted application to gain privileges or access sensitive information via the affected...

CVE-2014-9879

The CVE-2014-9879 issue affects the mdss mdp3 driver in the Qualcomm components on Nexus 5 devices running Android prior to 2016-08-05. The vulnerability arises because user-space data is not validated, enabling a locally staged attacker to gain privileges via a crafted application (Android inter...

CVE-2014-9944

CVE-2014-9944 affects the Secure File System in all Android CAF builds using the Linux kernel. The issue is described as an Integer Overflow that could lead to a Buffer Overflow. Available sources note the vulnerability at a high impact level (CVSSv3 base score 7.8; CVSSv2 9.3) with local attack ...

CVE-2015-0575

CVE-2015-0575 describes an insecure-cipher-suite issue in Qualcomm components used in Android builds (CAF Linux kernel). The connected CNVD-2017-26831 entry explicitly attributes the vulnerability to the Qualcomm closed‑source component in Android, arising from insecure default cipher configurati...

CVE-2015-1474

CVE-2015-1474 affects Android up to version 5.0, specifically the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp. The vulnerability arises from multiple integer overflows that can be triggered by inputs with a large number of file descriptors or large in...

CVE-2015-1529

The CVE-2015-1529 entry corresponds to an integer overflow in Android’s soundtrigger subsystem, specifically in soundtrigger/ISoundTriggerHwService.cpp. This vulnerability allows a denial of service through unspecified vectors by triggering an overflow in processing within the SoundTrigger hardwa...

CVE-2015-1537

Technical details about CVE-2015-1537 are not provided in the connected documents. The available descriptions mention an integer overflow in Android’s IHDCP.cpp but no further public technical specifics or fixes are included here. Monitor for updates.

CVE-2015-3870

CVE-2015-3870 affects Android’s libstagefright prior to 5.1.1 LMY48T. In these builds, processing a specially crafted media file could allow a remote attacker to execute arbitrary code or cause a denial of service via memory corruption in the mediaserver. The vulnerability stems from libstagefrig...

CVE-2015-6614

CVE-2015-6614 affects Android 5.x before 5.1.1 LMY48X in Telephony. The vulnerability is an elevation-of-privilege flaw that can allow a local malicious app to bypass intended network-interface restrictions, gain privileges, and enable actions such as bypassing restrictions, expensive data transf...

CVE-2015-6638

CVE-2015-6638 is an Elevation of Privilege vulnerability in the Imagination Technologies driver used by Android. A locally installed crafted application could gain kernel privileges on affected devices. AffectedPlatform: Android 5.x before 5.1.1 LMY49F and Android 6.0 before 2016-01-01. Root caus...

CVE-2015-8505

Summary (concrete details from provided sources): Android mediaserver in versions prior to 5.1.1 LMY48Z is vulnerable to a memory corruption issue that can be triggered by a crafted media file, enabling remote code execution or a denial of service. The entry is part of CVE-2015-8505 and is linked...

CVE-2015-8893

CVE-2015-8893 concerns the Qualcomm bootloader (aboot.c) in Android on Nexus 5 and Nexus 7 (2013) devices. A crafted application can cause a denial of service (OS outage or buffer over-read). The issue affects Android platforms pre-dating the 2016-07-05 patch level; the available connected docume...

CVE-2015-8940

Summary: CVE-2015-8940 describes an integer overflow in the Qualcomm sound driver component at sound/soc/msm/qdsp6v2/q6lsm.c on Nexus 6 devices running Android before 2016-08-05. The root cause is within the Qualcomm MSM qdsp6v2 driver, enabling a crafted application to escalate privileges locall...

CVE-2015-9020

Technical details about CVE-2015-9020 are not publicly available in the provided documents. Monitor for updates as new information becomes available.

CVE-2016-0808

CVE-2016-0808 is a local-denial-of-service vulnerability in the Android Minikin library. The issue arises from an integer overflow in getCoverageFormat12 (CmapCoverage.cpp) in Minikin, affecting Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01, potentially enabling a crafted TTF font to ...

CVE-2016-0842

CVE-2016-0842 affects libstagefright’s H.264 decoder in Android 6.x prior to 2016-04-01. The root cause is improper handling of MMCO data, enabling memory corruption that could allow remote code execution or a denial of service via crafted media files. Public details specify the affected componen...

CVE-2016-2409

Summary: CVE-2016-2409 affects a Texas Instruments haptic kernel driver used in Android 6.x. The vulnerability enables a local attacker to gain privileges in the kernel by exploiting a crafted application that targets a service which can call the TI haptic driver. This is described as an elevatio...

CVE-2016-2437

CVE-2016-2437 concerns the NVIDIA video driver in Android on Nexus 9 devices. The issue allows a locally executed, crafted application to gain privileges and execute code in the kernel context due to an internal bug (27436822). Public description confirms local privilege escalation with high impa...

CVE-2016-2506

CVE-2016-2506 affects Android Mediaserver (libstagefright DRMExtractor.cpp). The vulnerability arises from missing validation of a certain offset value in media processing, enabling a remote attacker to execute arbitrary code or cause memory corruption via a crafted media file. Affected Android v...

CVE-2016-3762

CVE-2016-3762 affects Android before patch levels: 5.0.2 for 5.0.x, 5.1.1 for 5.1.x, and 6.x before 2016-07-01. The issue is elevation of privileges in the sockets subsystem when a crafted application uses (1) AF_MSM_IPC or (2) another socket class unrecognized by SELinux, due to internal bug 286...

CVE-2016-3885

The CVE-2016-3885 entry concerns the Android debuggerd (Debuggerd) component, specifically debuggerd/debuggerd.cpp. The root cause is a mishandling of the interaction between PTRACE_ATTACH operations and thread exits in Debuggerd, which can allow a privileged escalation when a crafted app is run ...

CVE-2016-5854

CVE-2016-5854 involves a kernel information disclosure in Qualcomm SPCom driver components across Android for MSM, Firefox OS for MSM, and QRD Android. The underlying issue is that kernel heap memory can be exposed to userspace, enabling local information disclosure. Public documents list the aff...

CVE-2016-5857

The CVE-2016-5857 issue affects the Qualcomm SPCom driver in Android, where Android kernels prior to 7.0 allow local users to execute arbitrary code in kernel context via a crafted application. The vulnerability originates from the SPCom driver and enables a local escalation of privilege with com...

CVE-2016-5867

CVE-2016-5867 affects the Qualcomm sound driver in Android MSM (kernel sound subsystem). The root cause is that some variables originate from userspace and can be chosen to trigger a stack overflow, potentially enabling local impact. The initial description notes a stack overflow risk; CVSS3/2 me...

CVE-2016-6692

CVE-2016-6692 affects the Qualcomm MDSS driver in Android, specifically the mdss_mdp_pp.c component. The defect allows a denial of service (invalid pointer access) and possibly unspecified other impact via unknown vectors, tied to Qualcomm internal bug CR 1004933. The vulnerability is described f...

CVE-2016-6702

CVE-2016-6702 describes a remote code execution vulnerability in the libjpeg library used by Android. The issue allows an attacker to run arbitrary code in the context of an unprivileged process by feeding a specially crafted file. Affected Android versions are 4.x prior to 4.4.4, 5.0.x prior to ...

CVE-2016-6710

CVE-2016-6710 affects the Android Download Manager. The vulnerability is an information disclosure where a local malicious app could bypass OS data isolation to access data from other apps, arising in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01...

CVE-2016-6731

CVE-2016-6731 describes an elevation of privilege vulnerability in the NVIDIA GPU driver on Android prior to 2016-11-05. A local malicious app could execute arbitrary code in the kernel context , enabling a potential permanent device compromise. The issue is listed in public vulnerability tracker...

CVE-2016-6739

CVE-2016-6739 is an elevation-of-privilege vulnerability in the Qualcomm camera driver on Android, allowing a local malicious app to execute arbitrary code in the kernel context. The issue requires compromising a privileged process and is described as a local attack with high impact (kernel integ...

CVE-2016-6744

CVE-2016-6744: Elevation of privilege in the Synaptics touchscreen driver for Android. A local malicious app could execute arbitrary kernel code via the Synaptics driver, with impact classified as High. Affected software is Android devices using the Synaptics touchscreen driver prior to the 2016-...

CVE-2016-6767

CVE-2016-6767 describes a denial-of-service vulnerability in Mediaserver on Android 4.4.4 that could be triggered by a specially crafted file to cause a device hang or reboot. The primary affected component is Mediaserver (Android). The public material confirms the impact as DoS and notes remote ...

CVE-2016-8421

CVE-2016-8421 is an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver on Android. A local malicious app could execute arbitrary code in the kernel context by exploiting this driver vulnerability. Affected components/versions noted in provided docs include the Qualcomm Wi‑Fi driver...

CVE-2016-8445

CVE-2016-8445 describes an elevation of privilege in MediaTek components used by Android, specifically the thermal and video drivers. A local malicious application could execute arbitrary code in the kernel context, requiring a compromised privileged process first. The vulnerability is associated...

CVE-2017-0383

Technical details about CVE-2017-0383 are not publicly available in the provided connected documents. No vendor, version, impact, or remediation details are present here. Monitor for updates from official sources.

CVE-2017-0400

CVE-2017-0400 is an information-disclosure vulnerability affecting Android’s Audioserver (lvm/wrapper/Bundle/EffectBundle.cpp in libeffects). The issue could allow a local malicious application to access data outside its permission levels. Affected Android versions include 4.4.4, 5.0.2, 5.1.1, 6....

CVE-2017-0480

Technical details about CVE-2017-0480 are not publicly provided in the supplied documents. Monitor updates; current entries summarize impact but lack specific vulnerable components/versions within this dataset.

CVE-2017-0501

CVE-2017-0501 : Elevation of privilege in MediaTek components (including M4U, sound, touchscreen, GPU, and Command Queue drivers) could allow a local malicious app to execute arbitrary code in the kernel context on Android. The vulnerability is rated Critical due to potential permanent device com...