CVE-2018-11869

CVE-2018-11869 affects Android-family releases used on CAF/Linux kernels. The issue is a lack of length validation for a value received from firmware, which can cause a buffer overflow in the WMA handler . The vulnerability is described as local with potential complete impact on confidentiality, ...

CVE-2018-11956

Technical details about CVE-2018-11956 are not provided in the connected documents. The sources present only the general issue without specifics (affected components, root cause, impact, or fixes). Monitor for updates.

CVE-2018-5835

CVE-2018-5835 describes a potential buffer overflow in the Android WLAN stack: when seq_len exceeds CSR_MAX_RSC_LEN, copying keyRSC in __wlan_hdd_cfg80211_add_key() may overflow. This affects Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The ...

CVE-2018-5860

CVE-2018-5860 affects the MDSS (multimedia display) driver in Android builds for MSM, Firefox OS for MSM, and QRD Android, provided by CAF on Linux-based kernels. The root cause is that a data structure may be used without proper initialization, as described in multiple sources. According to the ...

CVE-2018-5889

CVE-2018-5889 affects Qualcomm bootloader components. The connected records classify it as a Local Elevation of Privilege (EoP) vulnerability in the bootloader, with a moderate severity. The issue is described as a buffer overflow occurring in Android releases from CAF when processing a compresse...

CVE-2025-36899

CVE-2025-36899 affects Google Pixel devices, with a local elevation-of-privilege (EoP) flaw in the Secure Element component. It stems from test/debugging code left in a production build, allowing privilege escalation without additional execution privileges or user interaction (per the CVE entry a...

CVE-2026-0139

CVE-2026-0139 affects the Modem with an out-of-bounds write caused by a missing bounds check, enabling remote code execution without privileges or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a base score of 8.8 (HIGH). The Android Pixel bulletin and related ...

CVE-2026-0141

CVE-2026-0141 describes a likely out-of-bounds read in decodeAppPacket of RtcpAppPacket.cpp caused by a missing bounds check. The vulnerability enables a remote information disclosure without requiring additional execution privileges and without user interaction. Public references in the provided...

CVE-2026-0148

The connected sources confirm a concrete issue in VideoRtpPayloadDecoderNode.cpp: an integer overflow can cause an out-of-bounds write, enabling remote code execution without extra privileges or user interaction. Affected component is VideoRtpPayloadDecoderNode.cpp (multiple functions). The CVE e...

CVE-2018-11893

CVE-2018-11893 is a vulnerability in CAF-based Android WLAN code (Linux kernel) where processing a vendor scan request can overflow a buffer when the input length of request IEs exceeds the maximum. The issue is documented across multiple Android CAF releases (Android for MSM, Firefox OS for MSM,...

CVE-2018-11909

CVE-2018-11909 describes an improper access-control issue in CAF-based Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel, where a device node/executable could be run from /cache/. The connected records do not provide concrete technical details about the vuln...

CVE-2018-11911

Affected software : Android releases (Android for MSM, Firefox OS for MSM, QRD Android) built with CAF Linux kernel. Root cause : improper configuration of a script, as described in CNVD-2018-25313. Impact : potential unprivileged access / privilege access control vulnerability. References in con...

CVE-2018-5908

CVE-2018-5908 affects CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The root cause is a missing buffer length validation in a display function, enabling a potential buffer overflow. CVSS indicates a local, low-complexity attack with HIGH impact acro...

CVE-2018-5910

CVE-2018-5910: In CAF-built Android (Android for MSM, Firefox OS for MSM, QRD Android) kernels, memory corruption can occur due to an improper check of the callers count parameter in display handler code. The issue affects the Linux kernel components used by CAF in these Android releases. Root ca...

CVE-2025-36928

CVE-2025-36928 : The issue is a potential out-of-bounds write in GetHostAddress of gxp_buffer.h caused by an incorrect bounds check. This can enable local escalation of privilege with no extra execution privileges required and no user interaction needed. Affected reports appear in multiple feeds ...

CVE-2018-11913

Technical details for CVE-2018-11913 are not publicly provided in the connected documents. The available records reiterate a generic issue related to dev node configuration in CAF/Linux kernel builds. Monitor for updates from official advisories.

CVE-2018-5847

CVE-2018-5847 describes a use-after-free condition arising from early/late retirement of rotation requests in CAF Android kernels (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel. Affected software is Android CAF kernel components; the underlying issue is a memory-managem...

CVE-2018-5851

CVE-2018-5851 is a Qualcomm WLAN buffer-overflow vulnerability affecting Android devices (Pixel/Nexus) due to HTT_T2H_MSG_TYPE_TX_COMPL_IND processing with an out-of-range num_msdus. The issue can allow arbitrary code execution or a DoS. Public details map this CVE to Qualcomm WLAN in the May 201...

CVE-2025-36897

CVE-2025-36897 involves an out-of-bounds write in cd_CnMsgCodecUserApi.cpp due to a missing bounds check, enabling remote code execution without extra privileges and without user interaction. Public sources (Pixel bulletin) classify the issue as RCE with High severity and note a 2025-09-05 patch ...

CVE-2026-0037

CVE-2026-0037 corresponds to a memory corruption issue in multiple functions of ffa.c, caused by a logic error. The CVE affects Google Android components and is described as enabling local escalation of privilege with no extra execution privileges and no user interaction required. The impact is n...

CVE-2026-0157

Summary of findings (CVE-2026-0157): The available documents consistently describe an out-of-bounds read in RtcpHeader::decodeRtcpHeader, caused by a missing bounds check. This leads to remote information disclosure without requiring user interaction; exploitation can occur over the network. The ...

CVE-2018-5888

CVE-2018-5888 affects Qualcomm bootloader components (Bootloader) with Elevation of Privilege (EoP) and Moderate severity. The CVE description references an out-of-bounds access while processing the system path in CAF Android MSM Linux kernel prior to the 2018-06-05 patch level; connected data al...

CVE-2025-36903

CVE-2025-36903 affects the lwis_io_buffer_write path (lwis) with an out-of-bounds read/write caused by insufficient input validation. The issue enables local elevation of privilege without extra execution privileges or user interaction (per the CVE description and corroborating sources). Public r...

CVE-2025-36907

CVE-2025-36907 affects the Android Pixel stack: a heap buffer overflow in the draw_surface_image() function of abl/android/lib/draw/draw.c allows an out-of-bounds write. This can lead to local elevation of privilege via USB fastboot after a bootloader unlock, with no additional execution privileg...

CVE-2025-36922

CVE-2025-36922 is a kernel-side issue in bigo_map() within bigo_iommu.c that enables information disclosure via a use-after-free, enabling local privilege escalation with SYSTEM-level execution privileges. Exploitation is not user-initiated. Affected platform details in public postings point to P...

CVE-2026-0146

CVE-2026-0146 affects the Exynos MFC component referenced in Pixel security bulletins. The issue is a possible out-of-bounds write in mfc_core_get_dec_metadata_sei_nal (within mfc_core_reg_api.c) caused by a missing bounds check, which could allow remote code execution with no privileges and no u...

CVE-2026-0149

CVE-2026-0149 describes a heap-based OOB write in RtpSession::rtpSendRtcpPacket that can lead to remote code execution with no extra privileges or user interaction. Affected component mentioned in Android Pixel bulletin is libpixelimsmedia. Connected sources (NVD/OSV) corroborate the same vulnera...

CVE-2025-36896

CVE-2025-36896 affects WLAN on Google Pixel devices running Android prior to the 2025-09-05 patch level. The issue is an elevation of privilege in the WLAN component; CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction required. The Pixel security bulletin groups th...

CVE-2025-36906

CVE-2025-36906 involves a heap-buffer overflow in the ConvertReductionOp of darwinn_mlir_converter_aidl.cc, causing an out-of-bounds write that can lead to local privilege escalation. The vulnerability is exploitable with local access and does not require user interaction. The source documents co...

CVE-2026-0108

The CVE-2026-0108 entry concerns misconfigured register protection on the PowerVR GPU, enabling local information disclosure without privileges or user interaction. The connected documents (Red Hat, ENISA EUVD, NVD, OSV, Android Pixel bulletin) describe the issue consistently but do not provide a...

CVE-2026-0125

CVE-2026-0125 is a local elevation-of-privilege issue caused by a use-after-free in vpu_ioctl.c across multiple functions, triggered by a race condition. The vulnerability allows a local attacker to escalate privileges without additional execution privileges or user interaction, as described in s...

CVE-2026-0130

CVE-2026-0130 affects the RtcpChunk::decodeRtcpChunk path, where a heap buffer overflow can cause an out-of-bounds read. This may lead to remote information disclosure without extra execution privileges. Exploitation requires user interaction. The provided documents do not specify affected produc...

CVE-2025-36921

CVE-2025-36921 affects Google Pixel devices via ProtocolPsUnthrottleApn() in protocolpsadapter.cpp, where a missing bounds check enables an out-of-bounds read that can lead to local information disclosure and requires baseband firmware compromise. The exploitation is reported as possible without ...

CVE-2025-48611

Summary of CVE-2025-48611 : The vulnerability is in the DeviceId.java code path (DeviceId class) where a missing bounds check can cause a desync in persistence, enabling local elevation of privilege without extra execution privileges or user interaction. This is consistently described across mult...

CVE-2026-0107

The CVE-2026-0107 issue lies in the function gmc_ddr_handle_mba_mr_req within gmc_mba_ddr.c, causing a possible local privilege escalation due to a confused deputy. No user interaction is required, and the vulnerability can be exploited locally with no additional privileges. The description is co...

CVE-2026-0126

In WC-Radio, there is a confirmed vulnerability causing an out-of-bounds write due to a missing bounds check. This can lead to remote code execution with no privileges and no user interaction required. The issue is detailed across multiple feeds (NVD entry CVE-2026-0126, EUVD-2026-, and related O...

CVE-2025-36905

CVE-2025-36905 describes a vulnerability in gxp_mapping_create within gxp_mapping.c, caused by a logic error that enables local privilege escalation with no additional privileges or user interaction required. Exploitation details are not provided in the connected documents. The Pixel bulletin ent...

CVE-2025-48610

CVE-2025-48610 stems from a logic error in mem_protect.c __pkvm_guest_relinquish_to_host, enabling a local information disclosure without required privileges or user interaction. Affected component: Android/Linux kernel KVM (pkvm) code path. Impact: potential leakage of configuration data. Exploi...

CVE-2025-48637

CVE-2025-48637 affects the Android/Linux kernel code path mem_protect.c, where an integer overflow can cause an out-of-bounds write. This leads to local escalation of privilege with no additional execution privileges required and no user interaction needed. Multiple connected sources (Red Hat CVE...

CVE-2026-0111

CVE-2026-0111 affects the function ns_GetUserData in ns_SmscbUtilities.c, where an incorrect bounds check can cause an out-of-bounds write. This vulnerability could enable remote escalation of privilege without user interaction. Connected documents (Red Hat CVE entry, NVD/NVD-based summaries, EUV...

CVE-2026-0120

CVE-2026-0120 affects the modem (baseband) and is caused by an incorrect bounds check leading to an out-of-bounds write. This could enable remote code execution without privileges and without user interaction. Public details across sources confirm the issue and its critical impact, but do not pro...

CVE-2025-36890

CVE-2025-36890 is a WLAN Elevation of Privilege issue affecting Google Pixel devices. The public details indicate a root cause in the BCM WiFi driver: an out‑of‑bounds/write issue when handling firmware messages, specifically when wl_notify_scan_status is invoked in response to the WLC_E_SCAN_COM...

CVE-2025-36894

CVE-2025-36894 is a DoS issue affecting Google Pixel devices, categorized under the Modem component in the Pixel update bulletin. The vulnerability stems from a missing null check, enabling remote denial of service without additional privileges or user interaction. The Android Pixel bulletin assi...

CVE-2025-36898

CVE-2025-36898 is a local elevation-of-privilege vulnerability affecting Google Pixel devices, tied to a logic error in the Pixel Sim Lock component. Exploitation requires local access; no user interaction is needed. The CVSS v3.1 score is 7.8 (High) with exploitation described as LOCAL, LOW comp...

CVE-2025-36937

CVE-2025-36937 affects the AudioDecoder::HandleProduceRequest path in audio_decoder.cc. The issue is an out-of-bounds write caused by an incorrect bounds check, which could enable remote code execution over the network without user interaction or extra privileges. Multiple connected sources (incl...

CVE-2026-0127

The CVE-2026-0127 entry describes an out-of-bounds read caused by memory corruption in NrmmMsgCodec::DecodeUPUTransparentContext (cn_NrmmDecoder.cpp). This vulnerability allows a remote denial of service (communication processor crash) with no user interaction and requires network access (per CVS...

CVE-2026-0165

CVE-2026-0165 is described across multiple sources as a vulnerability in the RTCP packet decoder where several functions perform an out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no execution privileges gained. Exploitation requires user in...

CVE-2025-36901

CVE-2025-36901 corresponds to a WLAN elevation-of-privilege issue affecting Android on Google Pixel devices prior to the 2025-09-05 patch. The vuln is described as an EoP in WLAN on Pixel, with the Pixel security bulletin listing CVE-2025-36901 as mitigated by the 2025-09-05 patch level. The prov...

CVE-2025-36908

The CVE-2025-36908 entry describes an out-of-bounds write in lwis_top_register_io within lwis_device_top.c that could enable local privilege escalation with System execution privileges required. The description and related entries confirm the vulnerable component is the lwis top logic. No exploit...

CVE-2025-36935

CVE-2025-36935 involves a memory corruption flaw in the function trusty_ffa_mem_reclaim inside shared-mem-smcall.c. The issue arises from uninitialized data and can enable local escalation of privilege without requiring extra execution privileges. Exploitation reportedly does not require user int...