CVE-2017-6423

CVE-2017-6423 is an elevation-of-privilege flaw in the Qualcomm Kyro L2 driver within the Android kernel. The vulnerability could allow a local attacker to execute arbitrary code with kernel privileges on affected devices (Pixel and Pixel XL are listed in the Android bulletin). The root cause is ...

CVE-2017-9722

CVE-2017-9722 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability arises when updating a custom EDID (hdmi_tx_sysfs_wta_edid) and the edid_size (controlled by userspace) is too large, causing a buffer overflow. Connected documents corrobo...

CVE-2018-11270

CVE-2018-11270 affects CAF builds for Android on MSM where a kernel path using devm_kzalloc can fail during probe, leading to automatic memory release by the kernel and potential data corruption. The description documents the root cause (memory management in the kernel) and the potential impact (...

CVE-2018-11902

CVE-2018-11902 affects Qualcomm WLAN host components in Android CAF builds; root cause is lack of length validation for a value received from firmware, leading to out-of-bounds access in WLAN HOST. The CVE is listed with High severity (per Qualcomm’s 2019-10-05 bulletin grouping for WLAN host). N...

CVE-2018-3561

CVE-2018-3561 is a Qualcomm Diagchar-related issue affecting Android on MSM devices. The root cause is a race condition in diag_ioctl_lsm_deinit() that leads to a Use-After-Free condition. The vulnerability is characterized as Elevation of Privilege (EoP) with local access requirements and high i...

CVE-2018-5830

CVE-2018-5830 describes a potential buffer overflow in the Android CAF/Linux kernel stack when processing the HTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND message, affecting Android for MSM, Firefox OS for MSM, and QRD Android builds prior to the 2018-06-05 patch level. Root cause is a buffer overflow in t...

CVE-2018-5887

CVE-2018-5887 affects Android builds from CAF using the Linux kernel, where processing the USB StrSerialDescriptor array can trigger an array index out-of-bounds. The issue is tied to Android for MSM, Firefox OS for MSM, and QRD Android releases prior to the 2018-06-05 security patch level. The C...

CVE-2020-0044

CVE-2020-0044 affects the Android FPC Fingerprint TEE in the Android kernel. In set_nonce of fpc_ta_qc_auth.c, there is an out-of-bounds read due to a missing bounds check, enabling local information disclosure with system execution privileges required. Exploitation is local and does not require ...

CVE-2021-0465

CVE-2021-0465 affects the Android kernel component used by Pixel devices, specifically the GenerateFaceMask function in face.cc. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local escalation of privilege with no extra execution privileges required and no user ...

CVE-2015-3830

Technical details for CVE-2015-3830 are not publicly available in the provided connected documents; monitor for updates.

CVE-2017-11074

CVE-2017-11074 affects Qualcomm WLAN in Android on MSM platforms (CAF-based kernels) via an obsolete set/reset ssid hotlist API in the WLAN stack. Root cause: legacy API left in kernel/UI interfaces enabling privilege escalation. Impact: as per CVSS, high confidentiality, integrity, and availabil...

CVE-2017-18154

CVE-2017-18154 describes a local elevation-of-privilege issue in Android’s media stack: a crafted binder request can trigger an arbitrary unmap in MediaServer on CAF-based Android (Android for MSM, Firefox OS for MSM, QRD Android) via the Linux kernel. Public details in NVD/Android bulletins indi...

CVE-2017-6262

The CVE-2017-6262 entry concerns an Elevation of Privilege in the NVIDIA driver within Android, caused by a race condition leading to a use-after-free, which could allow unauthorized code execution at the local attacker level and escalate privileges. The vulnerability is classified as EoP/High im...

CVE-2018-11261

Technical details about CVE-2018-11261 are not publicly provided in the supplied connected documents. Monitor for updates; no concrete affected products, versions, or fixes are confirmed in these sources.

CVE-2018-11273

The CVE-2018-11273 entry describes a double-free in voice_svc_dev when CAF’s Linux kernel device allocation hits cdev_alloc_err and device_destroy frees all resources. Affected are Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF’s kernel. The root cause is that voice_svc_dev...

CVE-2018-11826

CVE-2018-11826 causes a buffer overflow in the WLAN ext scan handler due to a missing check for integer overflow during memory size calculations in CAF Android/Linux kernel components. Affected: Qualcomm WLAN HOST (Android CAF stack). The issue is documented across multiple sources (NVD entry and...

CVE-2018-11840

CVE-2018-11840 describes a double free vulnerability in the WLAN driver ioctl handling in CAF Android/Linux kernel releases. The temporary buffer used to construct the reply can be freed twice, potentially enabling local exploitation with impacts to confidentiality, integrity, and availability as...

CVE-2018-11961

CVE-2018-11961 affects Qualcomm GPS_AP_LINUX (Android CAF/Linux kernel stack). Root cause: an out-of-bounds vector index when updating GNSS configurations. Impact: local access leading to potential elevation of privilege or code execution as indicated by CVSS metrics (CVSSv3: 7.8 HIGH; local vect...

CVE-2018-3564

CVE-2018-3564 affects the FastRPC driver in CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue is a Use-After-Free when mapping on the remote processor fails, potentially impacting components such as DSP_Services. The description notes that thi...

CVE-2018-3598

In CVE-2018-3598, the affected components are Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels prior to the 2018-04-05 patch level. The root cause is insufficient validation of parameters from userspace in the camera_v2 driver, leading to an information...

CVE-2018-5821

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with CAF builds prior to the 2018-04-05 kernel patch level, CVE-2018-5821 is a memory error in wma_wow_wakeup_host_event() where wake_info->vdev_id from FW is used as an index into wma->interfaces, potentially reading beyond t...

CVE-2018-5822

CVE-2018-5822 describes a buffer overwrite in WLAN firmware affecting Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android on CAF builds prior to the 2018-04-05 patch level. The issue arises from compromised WLAN FW and is mitigated by updating to the 2018-04-05 security patch level (or ...

CVE-2018-5844

CVE-2018-5844 describes a use-after-free in the Qualcomm video driver’s set_output_buffers() where binfo can be accessed after it is freed in a failure path across CAF Android for MSM, Firefox OS for MSM, and QRD Android (Linux kernel). The vulnerability affects the video driver component and has...

CVE-2018-5864

CVE-2018-5864 maps to a Qualcomm WMA information-disclosure vulnerability affecting Android devices (Pixel/Nexus) prior to the 2018-07-05 patch level. The issue arises during processing of WMI_APFIND events in CAF/Linux kernel-based Android builds, causing a potential buffer over-read and informa...

CVE-2020-0042

The CVE-2020-0042 issue affects the FPC Fingerprint TEE in Android’s fpc_ta_hw_auth_qsee.c. The root cause is a missing bounds check that enables an out-of-bounds read. This could allow local information disclosure and requires system privileges if exploited, with no user interaction needed. Expl...

CVE-2025-36893

CVE-2025-36893 describes a local information-disclosure vulnerability due to uninitialized data in ReadTachyonCommands within gxp_main_actor.cc. The issue can leak information with no additional execution privileges and no user interaction required. Affected component: the gxp main actor’s ReadTa...

CVE-2025-36909

CVE-2025-36909 is an information-disclosure vulnerability affecting WLAN in Google Pixel devices as described in the Pixel update bulletin. According to NVD and cross‑references, this issue is classified as Information disclosure with a CVSS 3.1 base score of 5.3 (Medium). The entry indicates an ...

CVE-2025-36921

CVE-2025-36921 affects Google Pixel devices via ProtocolPsUnthrottleApn() in protocolpsadapter.cpp, where a missing bounds check enables an out-of-bounds read that can lead to local information disclosure and requires baseband firmware compromise. The exploitation is reported as possible without ...

CVE-2025-36922

CVE-2025-36922 is a kernel-side issue in bigo_map() within bigo_iommu.c that enables information disclosure via a use-after-free, enabling local privilege escalation with SYSTEM-level execution privileges. Exploitation is not user-initiated. Affected platform details in public postings point to P...

CVE-2026-0147

CVE-2026-0147 affects the mfc_core_nal_q_get_dec_metadata_sei_nal function in mfc_core_nal_q.c. The issue is an out-of-bounds write caused by a missing bounds check, which the documents state could enable remote code execution with no extra privileges and no user interaction. The vulnerability is...

CVE-2016-11035

CVE-2016-11035 affects Samsung mobile devices with Exynos AP chipsets; a local user can trigger a kernel crash via the fb0(DECON) frame buffer interface. Connected sources reiterate this description, but no further technical details (affected versions, root cause specifics, exploit information, o...

CVE-2017-15830

CVE-2017-15830 affects the Qualcomm SME driver in Android on MSM (CAF Linux kernel lineage). The root cause is improper initialization of the ch_list array index in function sme_set_plm_request(), which can lead to a buffer overflow. The vulnerability is categorized as EoP (elevation of privilege...

CVE-2017-6425

CVE-2017-6425 is an information-disclosure vulnerability in the Qualcomm video driver embedded in the Android kernel. The issue affects Pixel and Pixel XL devices (and is tied to Qualcomm video components) and could allow a local attacker to access data outside of normal permission boundaries. Th...

CVE-2017-8271

CVE-2017-8271 describes an out-of-bounds memory write in the MDSS Rotator driver used by Qualcomm components on Android CAF builds using the Linux kernel. The issue arises from an unsanitized userspace-controlled parameter, enabling a local attacker to cause memory corruption. The CVSS indicates ...

CVE-2017-9708

The CVE-2017-9708 issue affects Android for MSM (and related CAF builds) in the camera driver. The race condition stems from msm_ois_power_down being invoked without a mutex, causing a race in the *reg_ptr variable within msm_camera_config_single_vreg. Impact is described as a race condition with...

CVE-2018-11869

CVE-2018-11869 affects Android-family releases used on CAF/Linux kernels. The issue is a lack of length validation for a value received from firmware, which can cause a buffer overflow in the WMA handler . The vulnerability is described as local with potential complete impact on confidentiality, ...

CVE-2018-11907

CVE-2018-11907 : Affects CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue is improper access control that can allow device nodes and executables to be run from /firmware/. The available documents reiterate the impact as a potential issue but ...

CVE-2018-11914

Technical details for CVE-2018-11914 are not publicly available in the provided documents. Monitor for updates.

CVE-2018-3563

CVE-2018-3563 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF kernel prior to the 2018-04-05 security patch level. The root cause is an untrusted pointer dereference in the function apr_cb_func , which can lead to arbitrary code execution. The vulnerability ...

CVE-2018-5824

In CVE-2018-5824, Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android on CAF-based Linux kernels prior to the 2018-04-05 patch level are vulnerable to a buffer overflow when processing HTT_T2H_MSG_TYPE_RX_FLUSH or HTT_T2H_MSG_TYPE_RX_PN_IND messages if the firmware tid value is out of r...

CVE-2018-5835

CVE-2018-5835 describes a potential buffer overflow in the Android WLAN stack: when seq_len exceeds CSR_MAX_RSC_LEN, copying keyRSC in __wlan_hdd_cfg80211_add_key() may overflow. This affects Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The ...

CVE-2018-5861

CVE-2018-5861 is documented as a heap-overflow risk in CAF Android bootloader code using the Linux kernel, affecting Android for MSM/QRD Android builds with Qualcomm bootloaders. The vulnerability arises from incomplete partition-size checks during loading of secure applications, with CVSS v3.0 i...

CVE-2018-5889

CVE-2018-5889 affects Qualcomm bootloader components. The connected records classify it as a Local Elevation of Privilege (EoP) vulnerability in the bootloader, with a moderate severity. The issue is described as a buffer overflow occurring in Android releases from CAF when processing a compresse...

CVE-2021-0455

The CVE-2021-0455 issue is described as an out-of-bounds write in the Citadel chip firmware, caused by a missing bounds check. It grants local elevation of privilege with System execution privileges required, and requires no user interaction to exploit. In the provided materials, the vulnerabilit...

CVE-2025-36895

CVE-2025-36895 is an information-disclosure vulnerability documented in the Pixel security bulletin, affecting the WLAN subcomponent. The Android bulletin lists it under Pixel with type ID, High severity, and affected as WLAN. The CVSSv3.1 vector indicates a Network attack vector, with Low attack...

CVE-2025-36899

CVE-2025-36899 affects Google Pixel devices, with a local elevation-of-privilege (EoP) flaw in the Secure Element component. It stems from test/debugging code left in a production build, allowing privilege escalation without additional execution privileges or user interaction (per the CVE entry a...

CVE-2026-0120

CVE-2026-0120 affects the modem (baseband) and is caused by an incorrect bounds check leading to an out-of-bounds write. This could enable remote code execution without privileges and without user interaction. Public details across sources confirm the issue and its critical impact, but do not pro...

CVE-2026-0139

CVE-2026-0139 affects the Modem with an out-of-bounds write caused by a missing bounds check, enabling remote code execution without privileges or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a base score of 8.8 (HIGH). The Android Pixel bulletin and related ...

CVE-2026-0156

CVE-2026-0156 describes a memory safety issue in checkSsrcCollisionOnRcv of RtpSession.cpp caused by a missing null check. This could allow remote denial of service without additional execution privileges, and exploitation does not require user interaction. The information appears consistently in...

CVE-2014-7919

CVE-2014-7919 affects Android in b/libs/gui/ISurfaceComposer.cpp, where a null pointer dereference can cause denial of service (process crash). Connected CNVD/NVD entries confirm the Android component and impact. No specific patch/version details or exploitation data are provided in the documents...