CVE-2011-0419

CVE-2011-0419 is a stack consumption/DoS vulnerability in the APR library’s fnmatch implementation (apr_fnmatch.c) and, for some platforms, in libc’s fnmatch.c. It affects APR < 1.4.3 and Apache HTTP Server

CVE-2025-26421

A logic error in the System component of the Android operating system allows for a lock screen bypass , which can lead to local escalation of privilege (EoP) without requiring additional execution privileges or user interaction. This vulnerability is addressed in security patch levels of 2025-05-...

CVE-2023-35657

A type confusion vulnerability exists in the bta_av_config_ind function of bta_av_aact.cc , which can lead to an out-of-bounds read . This flaw could result in local information disclosure without requiring additional execution privileges or user interaction. This issue is addressed in Android 13...

CVE-2024-49739

A security vulnerability exists in Google Android involving an out-of-bounds write within the MMapVAccess function of pmr_os.c . This flaw stems from improper input validation and allows a local attacker to achieve local escalation of privilege without requiring additional execution privileges or...

CVE-2025-26427

A path traversal error in multiple locations within the Android operating system allows for local escalation of privilege (EoP) without requiring additional execution privileges. Exploitation requires user interaction . This vulnerability affects the Framework component and the Documents UI subco...

CVE-2025-0077

A race condition exists in multiple functions of UserController.java within Google Android , which can be exploited to bypass the lock screen . This vulnerability allows for local escalation of privilege without requiring additional execution privileges or user interaction. Exploitation details a...

CVE-2019-9453

CVE-2019-9453 corresponds to an out-of-bounds read in the Android kernel F2FS touch driver, caused by improper input validation. This can enable local information disclosure and could potentially allow system-level privileges; exploitation requires local access with no user interaction. Publicly ...

CVE-2025-26420

A vulnerability in the Permission Controller component of Android allows for local elevation of privilege (EoP) without requiring additional execution privileges or user interaction. The issue stems from permission overload in multiple functions of GrantPermissionsActivity.java , which can trick ...

CVE-2025-26424

A logic error in multiple functions of VpnManager.java within the Google Android operating system can lead to a cross-user data leak . This vulnerability allows for local information disclosure without requiring additional execution privileges or user interaction. While the NCSC notes general And...

CVE-2025-26422

A security vulnerability exists in the WindowManagerService.java component of the Android operating system. The flaw is caused by a missing permission check , which allows for the execution of dumpsys without the required permissions. This could lead to a local escalation of privilege without nec...

CVE-2025-26425

A logic error in multiple functions of RoleService.java in Android causes a permission squatting vulnerability. This can lead to local elevation of privilege on versions where android.permission.MANAGE_DEFAULT_APPLICATIONS was not defined. Exploitation does not require user interaction. The issue...

CVE-2019-2219

CVE-2019-2219 affects the Android Framework, specifically when linked to NotificationManagerService and related files. The described issue is a local elevation of privilege due to a permission bypass that could allow recording audio from the background without user notification, requiring User ex...

CVE-2021-0605

CVE-2021-0605 is a kernel vulnerability disclosed in the Android/Linux kernel: in pfkey_dump of af_key.c, there is a missing bounds check causing a local out-of-bounds read that can disclose kernel information. Exploitation requires local privileges; no user interaction is needed. Connected advis...

CVE-2022-20008

CVE-2022-20008 affects the Android kernel via mmc_blk_read_single in block.c, where uninitialized data can allow reading kernel heap memory. This enables local information disclosure when reading from an SD card that triggers errors, with no additional privileges and no user interaction required....

CVE-2019-9449

The CVE-2019-9449 entry affects the Android kernel FingerTipS touchscreen driver. It describes a possible out-of-bounds read caused by a missing bounds check, leading to local information disclosure with system execution privileges required. No user interaction is needed for exploitation, and exp...

CVE-2019-9445

The CVE-2019-9445 entry describes a flaw in the Android kernel F2FS driver: an out-of-bounds read due to a missing bounds check, enabling local information disclosure with kernel privileges and no user interaction required. Connected Nessus advisories and Debian/Unity Linux advisories confirm the...

CVE-2019-9245

CVE-2019-9245 details (supported by connected docs): In the Android kernel, the f2fs driver contains a missing bounds check leading to a possible out-of-bounds read. This can cause local information disclosure and requires System privileges for exploitation, with no user interaction needed. The N...

CVE-2022-20465

CVE-2022-20465 affects Android 10–13 where a logic error in KeyguardHostViewController.java (and related files) can cause a lockscreen bypass via the dismiss() flow, enabling local privilege escalation without user interaction. Connected sources confirm the vulnerable component and impact; mitiga...

CVE-2019-9452

CVE-2019-9452 affects the Android kernel, specifically the SEC_TS touch driver. The issue is an out-of-bounds read caused by a missing bounds check, leading to local information disclosure with System execution privileges required. Exploitation does not require user interaction. The provided conn...

CVE-2020-0067

In CVE-2020-0067, the Linux kernel’s F2FS implementation (f2fs_xattr_generic_list in xattr.c) is vulnerable to an out-of-bounds read caused by a missing bounds check. This could enable local information disclosure and requires System privileges, with no user interaction needed for exploitation. T...

CVE-2022-20132

CVE-2022-20132 : The Android/Linux kernel contains an out-of-bounds read in the HID path (lg_probe and related hid-lg.c functions) due to improper input validation. This could allow local information disclosure when a malicious USB HID device is plugged in, with no privileges required and no user...

CVE-2020-0499

The CVE-2020-0499 entry concerns FLAC:bitreader_read_rice_signed_block where a heap buffer overflow can cause an out-of-bounds read, enabling remote information disclosure in Android-11. Exploitation reportedly requires user interaction; impact is information disclosure with low/medium severity d...

CVE-2019-9444

CVE-2019-9444 affects the Android kernel’s sync debugfs driver, where a kernel pointer leak occurs due to using printf with %p. This leads to potential local information disclosure with system privileges required for exploitation. The vulnerability can be triggered locally, and user interaction i...

CVE-2017-3544

CVE-2017-3544 is a content spoofing vulnerability in the Networking component of Oracle/OpenJDK’s Java SE/Java SE Embedded/JRockit, specifically an SMTP newline-injection issue in the SMTP client. The connected documents establish that a remote attacker could exploit this via SMTP to manipulate S...

CVE-2022-20423

CVE-2022-20423 is an Android kernel vulnerability arising in rndis_set_response() in rndis.c that allows an out-of-bounds write due to integer overflow. The issue can enable local privilege escalation when a malicious USB device is attached, with physical access required (no user interaction). Pu...

CVE-2026-20435

A logic error in the preloader of MediaTek chipsets (affecting approximately 875 million Android devices) allows for the reading of device unique identifiers. An attacker with physical access can exploit this via USB in under 45 seconds, even when the device is powered off, to bypass lock screens...

CVE-2023-21095

CVE-2023-21095 affects Android 12L and Android 13, in the canStartSystemGesture function of RecentsAnimationDeviceState.java. A race condition can cause a partial lockscreen bypass, enabling local privilege escalation without additional privileges or user interaction. Public references across mul...

CVE-2019-2231

CVE-2019-2231 affects the Android blob handling in Blob::Blob (blob.cpp), where improper input validation can lead to an unencrypted master key and local information disclosure. The issue requires local access with system privileges to exploit, with no user interaction needed. Public sources conf...

CVE-2022-20498

Technical details for CVE-2022-20498 are not provided in the connected documents. The initial description mentions an out-of-bounds read in fdt_ro.c causing local information disclosure, but lacks concrete product/version data or mitigations beyond the Android bulletin reference. Monitor for upda...

CVE-2022-20449

CVE-2022-20449 affects Android 10–13, in the writeApplicationRestrictionsLAr path, where a path traversal flaw could overwrite system files, enabling local DoS with system privileges and no user interaction. Exploitation specifics are not detailed in the provided documents. Android bulletins note...

CVE-2021-39711

The CVE-2021-39711 entry concerns the Linux kernel (Android kernel variant in the initial report) with a vulnerability in bpf_prog_test_run_skb() in test_run.c. The root cause is an out-of-bounds read due to an Incorrect Size Value, which can lead to local information disclosure and potentially p...

CVE-2022-20497

CVE-2022-20497 описывает возможность локального раскрытия информации через неправильное состояние в методе updatePublicMode в NotificationLockscreenUserManagerImpl.java на Android 12–13 (Android-12, Android-12L, Android-13). Уязвимость связана с тем, что в результате некорректного перехода состоя...

CVE-2023-20956

The CVE-2023-20956 entry affects Android 12–13 and is due to an out-of-bounds write in C2SurfaceSyncObj.cpp caused by a missing bounds check. This leads to potential local information disclosure with System-level privileges required; exploitation does not require user interaction. Public referenc...

CVE-2020-0068

CVE-2020-0068 affects the Android kernel audio driver (msm-cirrus-playback.c) via crus_afe_get_param, causing an out-of-bounds read due to an integer overflow. This can lead to local information disclosure with System privileges required; exploitation does not require user interaction. Documented...

CVE-2021-39715

The CVE refers to an information disclosure in the Android kernel: in __show_regs of process.c, log information disclosure could leak kernel memory/addresses, enabling local information leakage with SYSTEM privileges. Affected software: Android kernel components; vulnerable item: the show_regs pa...

CVE-2020-0075

CVE-2020-0075 affects the FPC Iris TZ App within Android (FPC component). Description: out-of-bounds read due to a missing bounds check in set_shared_key, enabling local information disclosure with System privileges required; no user interaction needed. Mode: Normal (concrete details provided). C...

CVE-2020-0077

CVE-2020-0077 affects the FPC Iris TZ App (TrustZone) on Android. Description: an out-of-bounds read in authorize_enroll due to a missing bounds check, enabling local information disclosure with System privileges needed; exploitation does not require user interaction. Connected sources corroborat...

CVE-2018-9383

A buffer overflow vulnerability exists in the asn1_ber_decoder function of asn1_decoder.c , caused by a lack of bounds checking. This flaw can lead to out-of-bounds reads of memory, potentially resulting in local information disclosure . Exploitation requires System execution privileges and does ...

CVE-2021-0320

CVE-2021-0320 affects Android 10/11, describing a race condition in keystore_keymaster_enforcement.h (is_device_locked and set_device_locked) that could bypass lockscreen requirements for keyguard-bound keys. This may lead to local information disclosure without additional privileges, and exploit...

CVE-2015-6644

CVE-2015-6644 : The vulnerability concerns Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01. A crafted application can cause the library to leak sensitive information, enabling an attacker who can force a user to run a malicious app to obtain private data. The connected docu...

CVE-2021-0961

CVE-2021-0961 affects the Android kernel via quota_proc_write in xt_quota2.c, enabling information disclosure by reading kernel memory due to uninitialized data. Impact is local: requires SYSTEM privileges with local access; user interaction is not required. Affected product scope is Android kern...

CVE-2016-0823

The CVE-2016-0823 entry concerns the Linux kernel vulnerability in which pagemap_open (fs/proc/task_mmu.c) on kernels before 3.19.3, including Android 6.0.1 before 2016-03-01, can let a local user read pagemap data to obtain sensitive physical-address information. This is triggered by reading the...

CVE-2021-39648

CVE-2021-39648 affects the Linux kernel gadget code path: the function gadget_dev_desc_UDC_show in configfs.c may disclose kernel heap memory due to a race condition, enabling local information disclosure with SYSTEM privileges (no user interaction required). Publicly documented references in And...

CVE-2021-39717

CVE-2021-39717 affects the Android kernel component iaxxx-btp.c (function iaxxx_btp_write_words). The issue is an out-of-bounds read caused by an incorrect bounds check, leading to local information disclosure with System privileges required. No exploitation details or user interaction informatio...

CVE-2018-9384

CVE-2018-9384 identifies a vulnerability in the Kernel component of Google Pixel and Nexus devices. The flaw allows an attacker with System execution privileges to bypass KASLR (Kernel Address Space Layout Randomization) due to an unusual root cause, potentially leading to local information discl...

CVE-2022-22266

Technical details about CVE-2022-22266 are not publicly available in the connected documents; the description provided is the extent of information here. Monitor for updates.

CVE-2021-0352

CVE-2021-0352 affects Android (Android-10/Android-11) via memory corruption in the RT regmap driver caused by a type confusion. This can lead to local denial of service with system execution privileges, and exploitation requires no user interaction. The patch referenced is ALPS05453809. The vulne...

CVE-2023-20780

The CVE-2023-20780 entry concerns MediaTek/MVK keyinstall: a missing bounds check in the keyinstall module can cause local information disclosure, requiring System privileges with no user interaction. Affected component is the keyinstall path; impact is local information disclosure with potential...

CVE-2021-39657

CVE-2021-39657 concerns an out-of-bounds read in the Android kernel’s ufshcd_eh_device_reset_handler (ufshcd.c). The issue enables local information disclosure with System privileges required, and does not require user interaction to exploit. The provided connected documents reiterate the same de...

CVE-2021-39724

CVE-2021-39724 is an Android/kernel issue: in TuningProviderBase::GetTuningTreeSet there is an out-of-bounds read due to a missing bounds check. This can enable local information disclosure with system privileges required. The vulnerability affects the Android kernel via tuning_provider_base.cc a...