CVE-2025-36901

CVE-2025-36901 corresponds to a WLAN elevation-of-privilege issue affecting Android on Google Pixel devices prior to the 2025-09-05 patch. The vuln is described as an EoP in WLAN on Pixel, with the Pixel security bulletin listing CVE-2025-36901 as mitigated by the 2025-09-05 patch level. The prov...

CVE-2025-36930

CVE-2025-36930 involves a potential out-of-bounds write in GetHostAddress of gxp_buffer.h, caused by a missing bounds check. This can lead to local elevation of privilege with no extra execution privileges or user interaction required. Multiple feeds (NVD, Red Hat, ENISA, CVE lists, and Android P...

CVE-2025-48624

CVE-2025-48624 is a local privilege-escalation vulnerability in the Linux kernel's ARM SMMU v3 driver (arm-smmu-v3.c) caused by improper input validation, leading to an out-of-bounds write in multiple functions. The issue could allow local escalation with no extra privileges and does not require ...

CVE-2026-0119

Summary: CVE-2026-0119 involves an out-of-bounds write caused by memory corruption in the function usim_SendMCCMNCIndMsg within usim_Registration.c. The vulnerability can enable a physical escalation of privilege with no additional execution privileges required and no user interaction needed. The...

CVE-2026-0127

The CVE-2026-0127 entry describes an out-of-bounds read caused by memory corruption in NrmmMsgCodec::DecodeUPUTransparentContext (cn_NrmmDecoder.cpp). This vulnerability allows a remote denial of service (communication processor crash) with no user interaction and requires network access (per CVS...

CVE-2026-0153

CVE-2026-0153: Out-of-bounds write in Write of msg_to_host_buffer.cc due to an incorrect bounds check; could enable local escalation of privilege with no user interaction. Pixel bulletin lists EdgeTPU as the affected subcomponent; initial materials do not publish a patch version or mitigation ste...

CVE-2025-36889

CVE-2025-36889 is a local information-disclosure vulnerability affecting Google Pixel devices in the Camera2 path. The issue arises in onCreateTasks of CameraActivity.java where a permission bypass due to a confused deputy could allow information disclosure without requiring additional execution ...

CVE-2026-0134

CVE-2026-0134 describes a data persistence issue in PostWipeData within recovery_ui.cpp, exposing local information after a factory reset due to a logic error. Impact is information disclosure with no additional privileges required and no user interaction needed. The available documents do not sp...

CVE-2026-0136

CVE-2026-0136 affects the Modem component, where a missing bounds check allows an out-of-bounds read. This can lead to remote denial of service without user interaction and with no additional execution privileges required. Public references consistently describe it as a DoS condition impacting Mo...

CVE-2026-0151

CVE-2026-0151 describes an out-of-bounds write in the function IntfGraphCreate() (intfgraph.c) caused by an integer overflow. The vulnerability could enable remote code execution with no required privileges and no user interaction. All connected sources consistently cite this exact issue and its ...

CVE-2026-0154

CVE-2026-0154 affects the Modem component and describes a memory corruption issue triggered by a SIP REFER request that could enable remote code execution with no additional privileges and without user interaction. The connected documents consistently state this is a Modem/SIP REFER memory corrup...

CVE-2025-36900

CVE-2025-36900 refers to an out-of-bounds write caused by an integer overflow in the function lwis_test_register_io within lwis_device_test.c. The impact described across multiple sources is local elevation of privilege requiring system execution privileges, with no user interaction needed. Affec...

CVE-2026-0030

CVE-2026-0030 affects Android kernel code, specifically the function __host_check_page_state_range in mem_protect.c. The issue is an out-of-bounds write caused by an incorrect bounds check, enabling local privilege escalation without user interaction. Public descriptions across NVD, Red Hat, NCSC...

CVE-2026-0116

CVE-2026-0116 targets the __mfc_handle_released_buf function in mfc_core_isr.c, where a missing bounds check allows an out-of-bounds write. This can enable remote code execution with no privileges or user interaction required. Multiple sources (NVD, Red Hat, EUVD, vuln enrichment, and OSV entries...

CVE-2026-0145

CVE-2026-0145 affects Keymint; a logic error allows a permission bypass leading to local information disclosure without extra privileges or user interaction. Exploitation status and fix details are not provided in the supplied documents; several sources list the issue but no patch information is ...

CVE-2025-32332

CVE-2025-32332 describes a use-after-free memory corruption in multiple locations, enabling local escalation of privilege with no additional execution privileges or user interaction. CVSSv3.1 base score 7.8 (LOCAL, HIGH). Exploitation is described as local; no exploit details are provided in the ...

CVE-2026-0155

CVE-2026-0155 describes an OOB read in ImsMediaBitReader::ReadByteBuffer caused by a missing bounds check. This leads to remote information disclosure without additional execution privileges and requires no user interaction. The CVSS 3.1 vector indicates Network access with low attack complexity ...

CVE-2025-36904

CVE-2025-36904 maps to a WLAN elevation-of-privilege issue on Google Pixel devices. Connected OSV data describes a Broadcom Wi‑Fi driver vulnerability in wl_android_get_best_channels, an out-of-bounds write caused by unvalidated list->count. The Pixel bulletin indicates updating to 2025-09-05 ...

CVE-2026-0109

CVE-2026-0109 affects the function dhd_tcpdata_info_get in dhd_ip.c, enabling a remote Denial of Service due to a precondition check failure. Exploitation requires no user interaction and can be remote (network vector). The strongest public context comes from Android Pixel bulletin entries, which...

CVE-2026-0128

CVE-2026-0128 affects code in RtcpFbPacket::decodeRtcpFbPacket, where an integer overflow can trigger an out-of-bounds read. This could lead to remote information disclosure without extra privileges. Exploitation requires user interaction. The connected documents consistently describe the same is...

CVE-2026-0132

CVE-2026-0132 concerns the Modem component. The connected documents describe a vulnerability where an out-of-bounds write occurs due to a heap buffer overflow, enabling remote code execution with no additional privileges and no user interaction required. The CVSS metrics indicate network attack v...

CVE-2025-36918

CVE-2025-36918 describes an out-of-bounds read in the function aoc_service_read_message within aoc_ipc_core.c , leading to a possible local escalation of privilege with System privileges required. The prerequisite is local access; no user interaction is needed. Connected sources consistently refe...

CVE-2025-36923

CVE-2025-36923 affects the NrmmDecoder::DecodeSORTransparentContext function in cn_NrmmDecoder.cpp, where a heap buffer overflow can cause an out-of-bounds write. This could enable remote (proximal/adjacent) escalation of privilege with no user interaction required. Exploitation details, affected...

CVE-2025-36925

CVE-2025-36925 affects WAVES_send_data_to_dsp in libaoc_waves.c, where a missing bounds check can cause an out-of-bounds write. This leads to local escalation of privilege with no additional execution privileges required, and no user interaction is needed for exploitation. The connected Red Hat a...

CVE-2025-36932

In the Google tracepoint IPC component, specifically in tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, a memory overwrite can occur due to improper input validation. This has the potential for local elevation of privilege without requiring additional execution privileges or...

CVE-2026-0158

CVE-2026-0158 affects the Camera component and describes an information disclosure vulnerability caused by a missing permission check that can allow local access to photos without extra execution privileges. Impact is local information disclosure (C: Low, I: None, A: None) with a CVSS 3.1 base sc...

CVE-2025-36916

CVE-2025-36916 affects code path in PrepareWorkloadBuffers of gxp_main_actor.cc, where a race condition can cause a double fetch. This permits local escalation of privilege with no extra execution privileges and no user interaction needed; exploitation is local. Connected documents corroborate th...

CVE-2025-36931

CVE-2025-36931: Out-of-bounds write in GetHostAddress of gxp_buffer.h allows local privilege escalation without user interaction. Documented in multiple sources (e.g., Android Pixel bulletin) as a local issue related to Pixel devices; patch guidance indicates updating to the December 2025 patch l...

CVE-2025-48613

The CVE-2025-48613 entry describes a vulnerability in VBMeta where an attacker can modify and resign VBMeta using a test key, assuming the original image was signed with the same key. This could enable local privilege escalation with no additional privileges or user interaction. Connected sources...

CVE-2026-0121

In VPU, a race condition enables a use-after-free read, causing local information disclosure without requiring privileges or user interaction. The issue is documented across multiple sources (NVD/Red Hat/OSV/ENISA/Android Pixel bulletin), with no publicly provided technical details on affected ve...

CVE-2026-0131

The CVE-2026-0131 entry affects the code path In RtpPacket::decodePacket, where an integer overflow can cause an out-of-bounds access. This vulnerability could enable local escalation of privilege with no additional execution privileges required, and exploitation requires user interaction. Connec...

CVE-2025-36891

CVE-2025-36891 is an Elevation of Privilege affecting the Pixel WLAN subsystem (Android). The Pixel Update Bulletin classifies it as WLAN-related EoP with High severity and CVSSv3.1: 8.8 (Network attack vector, low attack complexity, low privileges required, no user interaction, scopes unchanged;...

CVE-2025-36892

CVE-2025-36892 is a Denial of Service vulnerability documented across multiple feeds, with confirmed impact on Google Pixel WLAN components. The NVD/Red Hat/NVD entries describe DoS as the issue’s outcome, rated CVSSv3.1 base score 7.5 (Network, Low attack complexity, No privileges, No user inter...

CVE-2026-0133

Affected component: arm-smmu-v3.c (smmu_attach_dev). The issue is a missing permission check that can allow signing malicious Android Runtime bootclass artifacts, enabling local escalation of privilege without extra execution privileges. Exploitation requires local access; user interaction is not...

CVE-2026-0135

CVE-2026-0135 affects the Modem component, where a missing bounds check can enable an out-of-bounds read. This can lead to remote code execution with no additional privileges required and no user interaction. Several connected sources (NVD, EUVD-ENISA, CVE listings, OSV and PT-Security entries) c...

CVE-2026-0117

CVE-2026-0117 affects the MFC decoder path in mfc_dec_v4l2.c, where an incorrect bounds check enables an out-of-bounds write. This could lead to local escalation of privileges with no extra execution privileges required and no user interaction needed. The vulnerability is documented across multip...

CVE-2026-0137

CVE-2026-0137 affects the EdgeTPU kernel driver. The root cause is a use-after-free in the function edgetpu_sync_fence_group_shutdown() within edgetpu-dmabuf.c, which can enable a local elevation of privilege. The impact is local escalation to System execution privileges, with no user interaction...

CVE-2025-36920

CVE-2025-36920 describes an out-of-bounds write in the kernel component arch/arm64/kvm/hyp/nvhe/alloc.c’s hyp_alloc function caused by insufficient input validation. The vulnerability enables local escalation of privilege without requiring additional execution privileges, and exploitation reporte...

CVE-2025-36938

CVE-2025-36938 concerns a fault injection vulnerability in U-Boot function append_uint32_le() caused by a logic error in the code. The issue enables physical elevation of privilege with no additional execution privileges required and no user interaction needed. Multiple sources (NVD/Red Hat/OSVed...

CVE-2026-0113

CVE-2026-0113 describes an out-of-bounds write in ns_GetUserData within ns_SmscbUtilities.c that could enable remote escalation of privilege without user interaction. Affected references across multiple feeds corroborate the same flaw and classify it as a high-severity issue with a common-criteri...

CVE-2026-0129

The CVE-2026-0129 entry concerns RtcpByePacket::decodeByePacket with a missing bounds check that can lead to remote information disclosure. The available sources (NVD, OSV, PT security, Android Pixel bulletin) indicate this is related to libpixelimsmedia and triggers information disclosure withou...

CVE-2026-0160

The vulnerability CVE-2026-0160 affects the TextRtpPayloadDecoderNode, specifically in DecodeT140 of TextRtpPayloadDecoderNode.cpp. It is caused by a missing bounds check that can result in an out-of-bounds write. The documented impact is remote code execution with no additional privileges requir...

CVE-2025-36912

CVE-2025-36912: DoS in the cellular modem due to a logic error; network-triggered, no user interaction required, with availability impact. Affected: cellular modem components in Google Pixel Android devices as documented in the Pixel December 2025 bulletin and corroborated by Red Hat/NVD/USD feed...

CVE-2025-36924

CVE-2025-36924 describes an out-of-bounds write in ss_DecodeLcsAssistDataReqMsg() within ss_LcsManagement.c due to an incorrect bounds check. The impact is remote escalation of privilege with no additional execution privileges needed and no user interaction required. Connected sources include And...

CVE-2025-36919

CVE-2025-36919: A double-free condition in aocc_read within aoc_channel_dev.c due to improper locking enables local elevation of privilege. Exploitation requires local access (no user interaction). Multiple feeds (NVD/Red Hat/CNVD/CVELIST) reference the same issue with AoC component; Pixel Androi...

CVE-2026-0114

CVE-2026-0114 affects the Modem component, with an out-of-bounds write caused by an incorrect bounds check that could lead to remote code execution without user interaction or privileges. The description across Red Hat, NVD, EUVD, Android Pixel bulletin, and OSV entries consistently references th...

CVE-2026-0118

Technical details about CVE-2026-0118 are not publicly provided in the supplied documents. Monitor for updates from the sources listed; the available descriptions indicate a local privilege escalation via oobconfig bypass but lack specifics.

CVE-2026-0122

CVE-2026-0122 is reported in Pixel updates as a Remote Code Execution risk in the Baseband component, caused by an out-of-bounds write/memory corruption. Exploitation is described as requiring no user interaction and could allow remote code execution with high impact. The Pixel Bulletin lists the...

CVE-2026-0143

The CVE-2026-0143 issue is in LWIS (lwIS) device handling: in lwis_device_external_event_emit of lwis_event.c, a memory corruption via use-after-free is reported, enabling local escalation of privilege with System execution privileges, and no user interaction is required. Public documents from NV...

CVE-2025-36929

CVE-2025-36929 affects gxp_fence_manager.cc AreFencesRegistered. The issue is an information leak caused by improper input validation, enabling local information disclosure without extra privileges and without user interaction. Public exploitation details are not provided in the documents. The An...