CVE-2023-21222

CVE-2023-21222 : In the Android kernel, the vulnerability is in the function that parses device tree data (storage.c: load_dt_data). A missing bounds check can trigger an out-of-bounds write, enabling local escalation of privilege with System execution privileges required. User interaction is not...

CVE-2018-6240

CVE-2018-6240 affects NVIDIA Tegra BootRom. A local attacker with kernel privileges can write an arbitrary value to an arbitrary physical address, enabling escalation of privileges. Connected NVIDIA advisories confirm this vulnerability and map fixes to specific Jetson/Linux-for-Tegra releases: T...

CVE-2018-9407

CVE-2018-9407 : In emmc_rpmb_ioctl of emmc_rpmb.c there is a Missing Bounds Check, leading to potential information disclosure of kernel data. Connected sources confirm this issue on Google Pixel devices and reference the Android Pixel/Nexus security bulletin, which states that patch levels of 20...

CVE-2021-39638

CVE-2021-39638 relates to the Android kernel: in the function periodic_io_work_func of lwis_periodic_io.c there is an out-of-bounds write caused by a use-after-free. This leads to local elevation of privilege with System execution privileges required and no user interaction needed. The descriptio...

CVE-2021-39640

CVE-2021-39640 involves an out-of-bounds write in the Android kernel's dwc3 gadget ep0 queue function (__dwc3_gadget_ep0_queue) caused by improper locking. This vulnerability enables local privilege escalation with no user interaction, as documented across multiple sources (NVD, Red Hat, CNVD, OS...

CVE-2022-20561

CVE-2022-20561 affects the Android kernel in aud_hal_tunnel.c, where a use-after-free can cause memory corruption. The impact is local elevation of privilege with no extra execution privileges required and no user interaction needed. Affected component: Android kernel (aud_hal_tunnel.c). Root cau...

CVE-2023-35648

CVE-2023-35648 affects Google Pixel baseband firmware through a missing bounds check in ProtocolMiscLceIndAdapter::GetConfLevel() within protocolmiscadapter.cpp. This causes an out-of-bounds read that could enable remote information disclosure and requires baseband firmware compromise, with no us...

CVE-2018-9372

A local elevation of privilege vulnerability exists in the Google Android MediaTek component bootloader . The issue is caused by a missing bounds check in the cmd_flash_mmc_sparse_img function within dl_commands.c, which leads to a possible out-of-bounds write . An attacker can exploit this to ac...

CVE-2018-9393

CVE-2018-9393 is an Elevation of Privilege (EoP) vulnerability affecting the Linux kernel , specifically within the MediaTek wlan component. The root cause is a missing bounds check in the procfile_write function located in drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_proc.c, which al...

CVE-2018-9398

A local elevation of privilege (EoP) vulnerability exists in the MediaTek FM radio driver due to improper input validation in the fm_set_stat function. This flaw can result in an out-of-bounds write , allowing an attacker with System execution privileges to escalate privileges. No user interactio...

CVE-2019-11516

CVE-2019-11516 affects the Bluetooth stack in Cypress/Broadcom Wireless IoT. The issue arises from improper handling of Extended Inquiry Responses (EIRs): RFU bits are not discarded in eir_handleRx(), causing EIR length overflow beyond 240 bytes and a heap-based overflow in eir_getReceivedEIR() i...

CVE-2021-1041

CVE-2021-1041 is documented in multiple sources as a local, memory-corruption–related information-disclosure vulnerability affecting Android kernel components, with Pixel’s bulletin identifying it under the Camera entry and rating it High severity. The core issue is described as an out-of-bounds ...

CVE-2021-1047

CVE-2021-1047 affects Android kernel code (cm_access_control.c: valid_ipc_dram_addr). The issue arises from an integer overflow that enables an out-of-bounds read, leading to potential local information disclosure with system-level privileges. Exploitation is described as local and does not requi...

CVE-2022-42538

CVE-2022-42538 is listed in the Chromecast Security Bulletin as an Elevation of Privilege affecting Chromecast devices, under the AMLogic Secure Monitor component. The NVD entry assigns a CVSS v3.1 base score of 9.8 (CRITICAL), with network attack vector, low attack complexity, and no user intera...

CVE-2023-21146

CVE-2023-21146 affects the Android kernel. The described flaw is a use-after-free memory corruption that could enable local privilege escalation to SYSTEM with System execution privileges needed, and requires no user interaction. Exploitation details and concrete fixes are not provided in the sup...

CVE-2023-21160

CVE-2023-21160 affects the Android kernel via a heap buffer overflow in BuildSetTcsFci (protocolmiscbuilder.cpp) that can cause a local out-of-bounds read and information disclosure without requiring user interaction. Public details across sources confirm the impact as local information disclosur...

CVE-2026-0106

The Android VPU driver is vulnerable to a local privilege escalation (EoP) due to a missing bounds check in the vpu_mmap component of the vpu_ioctl function. This flaw allows an attacker to perform an arbitrary address mmap , potentially granting a low-privileged userland context arbitrary read/w...

CVE-2018-9391

CVE-2018-9391 describes a security issue in the Mediatek GPS HAL: in gpshal_worker.c, update_gps_sv and output_vzw_debug, there is a possible out-of-bounds write due to a missing bounds check. This can lead to local escalation of privilege with System execution privileges required; exploitation i...

CVE-2018-9396

A security vulnerability exists in the MediaTek CCCI component (specifically in drivers/misc/mediatek/eccci/port_rpc.c) due to an incorrect bounds check in the rpc_msg_handler and related handlers. This flaw can lead to an out-of-bounds write , potentially allowing for local escalation of privile...

CVE-2021-0526

CVE-2021-0526 concerns the Android memory management driver (MediaTek) with an out-of-bounds write caused by uninitialized data. The issue enables local escalation of privilege without extra execution privileges, and does not require user interaction. Multiple sources (NVD, Red Hat, CVE records, ...

CVE-2021-39650

CVE-2021-39650: In the Android kernel, an out-of-bounds write due to a missing bounds check enables local escalation to System privileges without user interaction. This is tied to Android kernel code and is documented with a MEDIUM base CVSS and LOCAL access. The provided connected documents conf...

CVE-2025-36887

Google Pixel devices are affected by a security vulnerability in the WLAN subcomponent. The issue stems from an incorrect bounds check in the wl_cfgscan_update_v3_schedscan_results() function of wl_cfgscan.c, which could allow an out-of-bounds write . This vulnerability could lead to a local elev...

CVE-2017-9681

In CVE-2017-9681, the issue affects Android devices using the Linux kernel in Qualcomm MSM/CAF builds (including Firefox OS for MSM and QRD Android). The vulnerability arises when a user-supplied kernel memory address is passed from userspace through the iris_vidioc_s_ext_ctrls ioctl, causing the...

CVE-2018-9403

The Google Pixel smartphone is susceptible to a stack buffer overflow vulnerability in the MTK_FLP_MSG_HAL_DIAG_REPORT_DATA_NTF handler located within flp2hal_interface.c. This issue is caused by a missing bounds check , which could allow an attacker to achieve local escalation of privilege in a ...

CVE-2021-1046

CVE-2021-1046 affects the Android kernel, specifically the lwis_dpm_update_clock function in lwis_device_dpm.c. The issue is an out-of-bounds read caused by an incorrect bounds check, which could enable local information disclosure with System-level privileges required. Exploitation does not requ...

CVE-2025-48647

A memory overwrite vulnerability exists in the cpm_fwtp_msg_handler function within the cpm/google/lib/tracepoint/cpm_fwtp_ipc.c file, affecting Google Pixel smartphones. The root cause is improper input validation , which could allow an attacker to achieve local escalation of privilege without r...

CVE-2017-13218

The CVE-2017-13218 entry documents a side-channel information-disclosure vulnerability caused by access to CNTVCT_EL0 in various ARM-based devices (e.g., Small Cell SoC, Snapdragon lines). Affected components include listed CPUs/SoCs (FSM9055, IPQ4019, IPQ8064, MDM9xxx, SD series, etc.) and relat...

CVE-2018-5829

The CVE-2018-5829 issue affects the WLAN stack in Android for MSM CAF builds (Linux kernel) and specifically the function wlan_hdd_cfg80211_set_privacy_ibss(). The vulnerability is a buffer over-read reported in Android releases using the affected CAF Linux kernel prior to the 2018-06-05 security...

CVE-2018-9364

CVE-2018-9364 corresponds to an Elevation of Privilege in the LG LGLAF bootloader component. The connected sources indicate the issue involves a special command that permitted modification of certain partitions, enabling bypass of secure boot. The Red Hat and Android bulletin entries corroborate ...

CVE-2019-2213

CVE-2019-2213 : A race in binder_free_transaction in binder.c can cause a use-after-free, enabling local privilege escalation without extra privileges. Exploitation is described as LOCAL with no user interaction and relies on the Android kernel’s binder subsystem; it references upstream kernel fi...

CVE-2021-39652

CVE-2021-39652 affects the Android kernel component, specifically the sec_ts_parsing_cmds code. The root cause is an incorrect bounds check that can trigger an out-of-bounds write, enabling local escalation of privilege with SYSTEM-level execution rights. Exploitation requires no user interaction...

CVE-2023-21159

CVE-2023-21159 affects the Android kernel component, specifically a missing bounds check in the Parse function of simdata.cpp, causing an out-of-bounds write that could enable local escalation of privilege with System-level execution rights and no user interaction required. In available connected...

CVE-2026-0031

The Google Android operating system is affected by an elevation of privilege vulnerability in the mem_protect.c component. The root cause is an integer overflow leading to a possible out-of-bounds write in multiple functions. A local attacker can exploit this vulnerability to gain elevated privil...

CVE-2026-0142

A vulnerability exists in the iavb_parse_key_data function of avb_rsa.c due to improper input validation, which can lead to an out-of-bounds read . This flaw may result in local information disclosure without requiring additional execution privileges or user interaction. The vulnerability specifi...

CVE-2017-11043

CVE-2017-11043 affects Qualcomm WLAN in Android (Android for MSM/CAF Linux kernel) with a WiFi driver function where an integer overflow may cause a heap buffer overflow. This is documented as a WLAN-related issue potentially enabling remote code execution. The provided sources describe the vulne...

CVE-2017-14891

CVE-2017-14891 affects the KGSL driver function _gpuobj_map_useraddr() in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-10-12. The issue is an uninitialized variable that can leak stack contents, causing information disclosure. The vulnerability is tied to the kernel/driver sta...

CVE-2017-18054

CVE-2017-18054 describes a buffer overflow risk in Qualcomm WMA within Android CAF builds, caused by improper input validation for num_vdev_mac_entries in wma_pdev_hw_mode_transition_evt_handler() and the value received from firmware. The vulnerability affects Android for MSM, Firefox OS for MSM,...

CVE-2018-9397

A vulnerability exists in the MTK WMT device driver due to a missing bounds check in the WMT_unlocked_ioctl function, which can lead to an out-of-bounds (OOB) write . This flaw could allow an attacker to achieve local escalation of privilege , requiring System execution privileges . Exploitation ...

CVE-2018-9408

The CVE-2018-9408 issue affects the GPS subsystem, specifically the m3326_gps_write and m3326_gps_read handlers in gps.s. The vulnerability is described as an out-of-bounds read caused by a missing bounds check, enabling local information disclosure with system execution privileges required. Expl...

CVE-2018-9462

An elevation of privilege vulnerability exists in the Google Android Kernel component due to an incorrect bounds check in the store_cmd function of ftm4_pdc.c. This flaw leads to a possible out-of-bounds write , which could allow an attacker to gain elevated privileges (EoP). The vulnerability af...

CVE-2022-26452

CVE-2022-26452 affects the isp component, describing a use-after-free caused by improper locking. The vulnerability enables local escalation of privilege with System execution privileges required and does not require user interaction. The available connected documents consistently cite a patch id...

CVE-2026-0029

A logic error in the __pkvm_init_vm function within pkvm.c on Google Android can lead to memory corruption . This vulnerability allows for local escalation of privilege without requiring additional execution privileges or user interaction. While some sources suggest this is a mismanagement of pri...

CVE-2014-9931

CVE-2014-9931 is a buffer overflow in CAF Linux kernel used by Android; triggered when an OEM customizes app region size due to a hard-coded value. Exploitation is local with user interaction; impact is high on confidentiality, integrity, and availability. No remediation details provided in the s...

CVE-2017-14906

CVE-2017-14906 affects Android on Qualcomm Snapdragon IoT devices (including Snapdragon Mobile MDM9206/MDM9607/MSM8909W, SD 210/212/205, SD 410/12) where PKCS7 padding is not supported by the crypto storage APIs. According to NVD, the issue is rated CVSS v3.0/9.8 (CRITICAL) with network attack ve...

CVE-2017-6284

CVE-2017-6284 describes a vulnerability in NVIDIA Security Engine’s DRBG where initialization/storage of sensitive data is flawed and encryption is weakened, potentially leading to information disclosure. NVIDIA’s NVIDIA Jetson TX1/TX2 Linux for Tegra updates (R28.3) address multiple issues inclu...

CVE-2018-5841

CVE-2018-5841 affects Qualcomm DCC (display/graphics driver) within Android CAF releases. The root cause is that dcc_curr_list is initialized to a default invalid value, which is intended to be programmed via a sysfs node; this could allow an elevation of privilege (EoP) when the value is imprope...

CVE-2018-5865

CVE-2018-5865 affects Qualcomm fwlog in Android CAF/Linux kernel builds prior to the 2018-07-05 patch level. The issue is described as an integer underflow and/or buffer over-read in processing a debug log event, leading to information disclosure (high impact on confidentiality per CVSS3, local, ...

CVE-2018-9366

CVE-2018-9366 affects Google/Android devices with the MediaTek IMSA component. In IMSA_Recv_Thread and VT_IMCB_Thread (IMSAClient.cpp and VideoTelephony.c), an out-of-bounds write due to an integer overflow is described, leading to local escalation of privilege with no user interaction required. ...

CVE-2018-9371

A vulnerability exists in the Mediatek Preloader bootloader component used in Google Android devices. The root cause is an exposed interface that permits arbitrary peripheral memory mapping due to insufficient blacklisting or whitelisting. This flaw results in out-of-bounds reads and writes , whi...

CVE-2016-8488

CVE-2016-8488 is an elevation-of-privilege vulnerability in Qualcomm closed-source components within Android, affecting the Android kernel. The issue is described as an elevation of privilege in Qualcomm components used by Android devices; the CVSSv3 metrics indicate a CRITICAL impact with networ...