CVE-2011-0419

CVE-2011-0419 is a stack consumption/DoS vulnerability in the APR library’s fnmatch implementation (apr_fnmatch.c) and, for some platforms, in libc’s fnmatch.c. It affects APR < 1.4.3 and Apache HTTP Server

CVE-2023-35657

CVE-2023-35657 affects the Bluetooth stack component bta_av_config_ind in bta_av_aact.cc, where a type confusion can cause an out-of-bounds read leading to local information disclosure without extra privileges or user interaction. Public references indicate this vulnerability is tracked in Androi...

CVE-2025-26421

CVE-2025-26421 affects the Android platform System component. The issue is a logic error that enables local escalation of privilege via a lock-screen bypass, with no user interaction required. Impact is described as Elevation of Privilege (EoP) on the device. AOSP patches update the System compon...

CVE-2024-49739

CVE-2024-49739 describes an out-of-bounds write in the function MMapVAccess within pmr_os.c, caused by insufficient input validation. This could enable local privilege escalation with no required user interaction. The CVE is reflected across multiple sources (NVD, Red Hat, OSV) and is associated ...

CVE-2025-0077

CVE-2025-0077 affects Android’s framework with a race condition in multiple functions of UserController.java. The issue is a buffer copy flaw that lacks input size validation, potentially enabling a local elevation of privilege (EoP) without extra execution privileges and without user interaction...

CVE-2025-26427

CVE-2025-26427 affects Google Android Framework; a path traversal error in multiple locations can grant local escalation of privilege. Exploitation requires user interaction, with no additional execution privileges needed. According to the Android bulletin, this issue is addressed in patch levels...

CVE-2025-26425

The CVE-2025-26425 entry describes a local privilege-escalation issue in Android related to RoleService.java, caused by a logic error that enables permission squatting when android.permission.MANAGE_DEFAULT_APPLICATIONS is not defined. Exploitation is stated to require no user interaction, and th...

CVE-2025-26420

CVE-2025-26420 concerns Android’s GrantPermissionsActivity.java, where a permission overload vulnerability may allow an attacker to mislead a user into granting the wrong permission, enabling local privilege escalation. The issue is described across multiple feeds as affecting the System/Permissi...

CVE-2025-26422

CVE-2025-26422 affects Android’s WindowManagerService (dumpsys) where a missing permission check could allow a local elevation of privilege. The public description notes that exploitation requires local access with no extra privileges and no user interaction. Android security bulletin entries for...

CVE-2025-26424

The CVE CVE-2025-26424 concerns VpnManager.java in the Android framework, where a logic error enables cross-user data leakage. The impact is local information disclosure without extra privileges or user interaction. Exploitation details are not provided in the connected documents, and there is no...

CVE-2019-9453

CVE-2019-9453 corresponds to an out-of-bounds read in the Android kernel F2FS touch driver, caused by improper input validation. This can enable local information disclosure and could potentially allow system-level privileges; exploitation requires local access with no user interaction. Publicly ...

CVE-2019-2219

CVE-2019-2219 affects the Android Framework, specifically when linked to NotificationManagerService and related files. The described issue is a local elevation of privilege due to a permission bypass that could allow recording audio from the background without user notification, requiring User ex...

CVE-2021-0605

CVE-2021-0605 is a kernel vulnerability disclosed in the Android/Linux kernel: in pfkey_dump of af_key.c, there is a missing bounds check causing a local out-of-bounds read that can disclose kernel information. Exploitation requires local privileges; no user interaction is needed. Connected advis...

CVE-2022-20008

CVE-2022-20008 affects the Android kernel via mmc_blk_read_single in block.c, where uninitialized data can allow reading kernel heap memory. This enables local information disclosure when reading from an SD card that triggers errors, with no additional privileges and no user interaction required....

CVE-2019-9449

The CVE-2019-9449 entry affects the Android kernel FingerTipS touchscreen driver. It describes a possible out-of-bounds read caused by a missing bounds check, leading to local information disclosure with system execution privileges required. No user interaction is needed for exploitation, and exp...

CVE-2019-9445

The CVE-2019-9445 entry describes a flaw in the Android kernel F2FS driver: an out-of-bounds read due to a missing bounds check, enabling local information disclosure with kernel privileges and no user interaction required. Connected Nessus advisories and Debian/Unity Linux advisories confirm the...

CVE-2019-9245

CVE-2019-9245 details (supported by connected docs): In the Android kernel, the f2fs driver contains a missing bounds check leading to a possible out-of-bounds read. This can cause local information disclosure and requires System privileges for exploitation, with no user interaction needed. The N...

CVE-2019-9452

CVE-2019-9452 affects the Android kernel, specifically the SEC_TS touch driver. The issue is an out-of-bounds read caused by a missing bounds check, leading to local information disclosure with System execution privileges required. Exploitation does not require user interaction. The provided conn...

CVE-2020-0067

In CVE-2020-0067, the Linux kernel’s F2FS implementation (f2fs_xattr_generic_list in xattr.c) is vulnerable to an out-of-bounds read caused by a missing bounds check. This could enable local information disclosure and requires System privileges, with no user interaction needed for exploitation. T...

CVE-2022-20132

CVE-2022-20132 : The Android/Linux kernel contains an out-of-bounds read in the HID path (lg_probe and related hid-lg.c functions) due to improper input validation. This could allow local information disclosure when a malicious USB HID device is plugged in, with no privileges required and no user...

CVE-2019-9444

CVE-2019-9444 affects the Android kernel’s sync debugfs driver, where a kernel pointer leak occurs due to using printf with %p. This leads to potential local information disclosure with system privileges required for exploitation. The vulnerability can be triggered locally, and user interaction i...

CVE-2022-20465

CVE-2022-20465 affects Android 10–13 where a logic error in KeyguardHostViewController.java (and related files) can cause a lockscreen bypass via the dismiss() flow, enabling local privilege escalation without user interaction. Connected sources confirm the vulnerable component and impact; mitiga...

CVE-2020-0499

The CVE-2020-0499 entry concerns FLAC:bitreader_read_rice_signed_block where a heap buffer overflow can cause an out-of-bounds read, enabling remote information disclosure in Android-11. Exploitation reportedly requires user interaction; impact is information disclosure with low/medium severity d...

CVE-2017-3544

CVE-2017-3544 is a content spoofing vulnerability in the Networking component of Oracle/OpenJDK’s Java SE/Java SE Embedded/JRockit, specifically an SMTP newline-injection issue in the SMTP client. The connected documents establish that a remote attacker could exploit this via SMTP to manipulate S...

CVE-2022-20423

CVE-2022-20423 is an Android kernel vulnerability arising in rndis_set_response() in rndis.c that allows an out-of-bounds write due to integer overflow. The issue can enable local privilege escalation when a malicious USB device is attached, with physical access required (no user interaction). Pu...

CVE-2022-20498

Technical details for CVE-2022-20498 are not provided in the connected documents. The initial description mentions an out-of-bounds read in fdt_ro.c causing local information disclosure, but lacks concrete product/version data or mitigations beyond the Android bulletin reference. Monitor for upda...

CVE-2019-2231

CVE-2019-2231 affects the Android blob handling in Blob::Blob (blob.cpp), where improper input validation can lead to an unencrypted master key and local information disclosure. The issue requires local access with system privileges to exploit, with no user interaction needed. Public sources conf...

CVE-2023-21095

CVE-2023-21095 affects Android 12L and Android 13, in the canStartSystemGesture function of RecentsAnimationDeviceState.java. A race condition can cause a partial lockscreen bypass, enabling local privilege escalation without additional privileges or user interaction. Public references across mul...

CVE-2021-39711

The CVE-2021-39711 entry concerns the Linux kernel (Android kernel variant in the initial report) with a vulnerability in bpf_prog_test_run_skb() in test_run.c. The root cause is an out-of-bounds read due to an Incorrect Size Value, which can lead to local information disclosure and potentially p...

CVE-2022-20449

CVE-2022-20449 affects Android 10–13, in the writeApplicationRestrictionsLAr path, where a path traversal flaw could overwrite system files, enabling local DoS with system privileges and no user interaction. Exploitation specifics are not detailed in the provided documents. Android bulletins note...

CVE-2023-20956

The CVE-2023-20956 entry affects Android 12–13 and is due to an out-of-bounds write in C2SurfaceSyncObj.cpp caused by a missing bounds check. This leads to potential local information disclosure with System-level privileges required; exploitation does not require user interaction. Public referenc...

CVE-2022-20497

CVE-2022-20497 описывает возможность локального раскрытия информации через неправильное состояние в методе updatePublicMode в NotificationLockscreenUserManagerImpl.java на Android 12–13 (Android-12, Android-12L, Android-13). Уязвимость связана с тем, что в результате некорректного перехода состоя...

CVE-2020-0068

CVE-2020-0068 affects the Android kernel audio driver (msm-cirrus-playback.c) via crus_afe_get_param, causing an out-of-bounds read due to an integer overflow. This can lead to local information disclosure with System privileges required; exploitation does not require user interaction. Documented...

CVE-2020-0075

CVE-2020-0075 affects the FPC Iris TZ App within Android (FPC component). Description: out-of-bounds read due to a missing bounds check in set_shared_key, enabling local information disclosure with System privileges required; no user interaction needed. Mode: Normal (concrete details provided). C...

CVE-2020-0077

CVE-2020-0077 affects the FPC Iris TZ App (TrustZone) on Android. Description: an out-of-bounds read in authorize_enroll due to a missing bounds check, enabling local information disclosure with System privileges needed; exploitation does not require user interaction. Connected sources corroborat...

CVE-2021-39715

The CVE refers to an information disclosure in the Android kernel: in __show_regs of process.c, log information disclosure could leak kernel memory/addresses, enabling local information leakage with SYSTEM privileges. Affected software: Android kernel components; vulnerable item: the show_regs pa...

CVE-2021-0320

CVE-2021-0320 affects Android 10/11, describing a race condition in keystore_keymaster_enforcement.h (is_device_locked and set_device_locked) that could bypass lockscreen requirements for keyguard-bound keys. This may lead to local information disclosure without additional privileges, and exploit...

CVE-2021-0961

CVE-2021-0961 affects the Android kernel via quota_proc_write in xt_quota2.c, enabling information disclosure by reading kernel memory due to uninitialized data. Impact is local: requires SYSTEM privileges with local access; user interaction is not required. Affected product scope is Android kern...

CVE-2018-9383

CVE-2018-9383 is a vulnerability in the Linux kernel where the asn1_ber_decoder in lib/asn1_decoder.c allows an out-of-bounds read due to a missing bounds check. This can lead to local information disclosure and, per the description, system execution privileges could be required for exploitation;...

CVE-2021-0352

CVE-2021-0352 affects Android (Android-10/Android-11) via memory corruption in the RT regmap driver caused by a type confusion. This can lead to local denial of service with system execution privileges, and exploitation requires no user interaction. The patch referenced is ALPS05453809. The vulne...

CVE-2015-6644

CVE-2015-6644 : The vulnerability concerns Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01. A crafted application can cause the library to leak sensitive information, enabling an attacker who can force a user to run a malicious app to obtain private data. The connected docu...

CVE-2021-39717

CVE-2021-39717 affects the Android kernel component iaxxx-btp.c (function iaxxx_btp_write_words). The issue is an out-of-bounds read caused by an incorrect bounds check, leading to local information disclosure with System privileges required. No exploitation details or user interaction informatio...

CVE-2016-0823

The CVE-2016-0823 entry concerns the Linux kernel vulnerability in which pagemap_open (fs/proc/task_mmu.c) on kernels before 3.19.3, including Android 6.0.1 before 2016-03-01, can let a local user read pagemap data to obtain sensitive physical-address information. This is triggered by reading the...

CVE-2021-39648

CVE-2021-39648 affects the Linux kernel gadget code path: the function gadget_dev_desc_UDC_show in configfs.c may disclose kernel heap memory due to a race condition, enabling local information disclosure with SYSTEM privileges (no user interaction required). Publicly documented references in And...

CVE-2023-20780

The CVE-2023-20780 entry concerns MediaTek/MVK keyinstall: a missing bounds check in the keyinstall module can cause local information disclosure, requiring System privileges with no user interaction. Affected component is the keyinstall path; impact is local information disclosure with potential...

CVE-2021-39722

CVE-2021-39722 affects ProtocolStkProactiveCommandAdapter::Init in protocolstkadapter.cpp, with an out-of-bounds read caused by an incorrect bounds check. This could allow local information disclosure and requires system privileges, with no user interaction needed. Connected sources (OSV entry) c...

CVE-2021-39724

CVE-2021-39724 is an Android/kernel issue: in TuningProviderBase::GetTuningTreeSet there is an out-of-bounds read due to a missing bounds check. This can enable local information disclosure with system privileges required. The vulnerability affects the Android kernel via tuning_provider_base.cc a...

CVE-2021-39657

CVE-2021-39657 concerns an out-of-bounds read in the Android kernel’s ufshcd_eh_device_reset_handler (ufshcd.c). The issue enables local information disclosure with System privileges required, and does not require user interaction to exploit. The provided connected documents reiterate the same de...

CVE-2018-9384

CVE-2018-9384 is documented in the Pixel/Android security context as a kernel‑level issue (Kernel components → Upstream kernel) that could enable bypassing KASLR, potentially allowing local information disclosure with SYSTEM privileges. The description consistently notes a “unusual root cause” an...

CVE-2022-42771

Technical details about CVE-2022-42771 are not publicly provided in the supplied documents. The entries reference a WLAN driver race condition causing local DoS, but no vendor, version, or patch information is included here. Monitor for updates.