CVE-2023-40113

CVE-2023-40113 affects the Android platform (System component) and stems from a missing permission check that allowed apps to access cross‑user message data. This enables local information disclosure without extra privileges or user interaction. Public details in the provided documents are limite...

CVE-2023-40093

CVE-2023-40093 is an information-disclosure vulnerability in Google Android where trimmed content could be included in PDF output due to a logic error. It allows local information disclosure with no user interaction; confidentiality is impacted. Public sources cite this CVE in Android security bu...

CVE-2024-0017

CVE-2024-0017 involves a permissions bypass in the shouldUseNoOpLocation function of CameraActivity.java, creating a possible confused deputy and leading to local information disclosure without requiring additional execution privileges. Exploitation requires user interaction. The vulnerability is...

CVE-2024-0030

CVE-2024-0030 affects the Android Bluetooth stack: the out-of-bounds read arises in btif_to_bta_response within btif_gatt_util.cc due to an incorrect bounds check. This can cause local information disclosure without extra privileges. User interaction is not required. Exploitation details (vectors...

CVE-2023-40124

CVE-2023-40124 involves a local information disclosure (cross-user read) due to a confused deputy. Public docs from NVD/Red Hat/OSV describe impact as local, with no execution privileges required and no user interaction needed. Android security bulletin entries for 2023-11-01/05 group this under ...

CVE-2023-40085

CVE-2023-40085 involves a missing bounds check in ShimConverter.cpp, in the function convertSubgraphFromHAL , which can trigger a possible out-of-bounds read. This leads to local information disclosure with no additional execution privileges required and no user interaction. The connected documen...

CVE-2023-40105

CVE-2023-40105 affects the Android framework (ActivityManagerService), specifically in backupAgentCreated. The root cause is a missing permission check in this path, enabling local information disclosure. The impact is high confidentiality loss with no integrity or availability impact described, ...

CVE-2023-40112

CVE-2023-40112 describes a likely out-of-bounds read in the printer subsystem: the function ippSetValueTag in ipp.c performs a missing bounds check, potentially allowing local disclosure of past print jobs or other print-related data. Exploitation is described as local (no remote access) with no ...

CVE-2024-0020

CVE-2024-0020 affects the Android platform component NotificationSoundPreference.java. The flaw arises in onActivityResult, enabling a confused deputy to disclose audio files belonging to another user on the same device. Exploitation is local, requires no user interaction, and can lead to local i...

CVE-2024-0022

CVE-2024-0022 affects Android’s CompanionDeviceManagerService.java. The issue is improper input validation that can cause a NotificationAccessConfirmationActivity to be launched for another user profile, enabling local information disclosure without extra privileges and without user interaction. ...

CVE-2024-0027

The CVE-2024-0027 issue affects Google Android’s SnoozeHelper.java, where multiple methods can exhaust resources and cause a local boot loop/denial of service. Vulnerability details across connected sources consistently describe a DoS resulting from resource exhaustion with no extra privileges an...

CVE-2023-21036

The CVE-2023-21036 issue affects Google Pixel devices' Markup tool (BitmapExport.java) where a logic error prevents proper truncation of image data after edits, potentially leaving remnants of the original image in cropped/edited PNGs. Public sources (NVD/NVD entry, CVE lists) describe a local, p...

CVE-2024-40659

CVE-2024-40659 concerns Android’s RemoteProvisioningService.getRegistration, where improper input validation could allow an attacker to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps. This yields a local Denial of Service with...

CVE-2024-49736

Google Android is affected by a denial-of-service vulnerability caused by a logic error in the MainClear.java file. An attacker can exploit this error to trigger a factory reset without explicit user consent. This attack requires no additional execution privileges and does not require user intera...

CVE-2016-2107

CVE-2016-2107 (OpenSSL) is a padding-oracle vulnerability in the AES-NI CBC MAC check. The issue arises in the AES-CBC padding validation where memory allocation during the padding check is mishandled, enabling potential leakage of plaintext under certain conditions. Affected OpenSSL versions inc...

CVE-2024-49733

Google Android is affected by an information disclosure vulnerability caused by a logic error in the code within ServiceListing.java . A malicious application could exploit this to hide an NLS from Settings , leading to local information disclosure without requiring additional execution privilege...

CVE-2018-9447

A local denial of service vulnerability exists in the Google Android System due to a missing null check in the onCreate method of EmergencyCallbackModeExitDialog.java. An attacker can exploit this flaw to crash the emergency callback mode without requiring additional execution privileges or user ...

CVE-2018-9379

The MiniThumbFile.java component in Google Pixel and Google Nexus smartphones contains a confused deputy vulnerability in multiple functions. This flaw allows an attacker to view thumbnails of deleted photos, leading to local information disclosure without requiring additional execution privilege...

CVE-2025-0087

Google Android is vulnerable to a local escalation of privilege due to a missing permission check in the onCreate function of UninstallerActivity.java . An attacker can exploit this flaw to uninstall applications belonging to different users without requiring additional execution privileges or us...

CVE-2025-26426

A vulnerability exists in the Framework component of the Android operating system within the registerReceiverWithFeatureTraced function of BroadcastController.java. Due to improper input validation (specifically related to receiving broadcasts intended for the "android" package), a local attacker...

CVE-2020-0404

CVE-2020-0404 affects the Android kernel via a vulnerability in uvc_scan_chain_forward() in uvc_driver.c, where an unusual root cause can cause linked list corruption and local privilege escalation without user interaction. Upstream kernel reports indicate this is a kernel linked-list corruption ...

CVE-2024-50302

CVE-2024-50302 affects the Linux kernel HID core by leaving the HID report buffer potentially uninitialized, enabling possible memory leakage via crafted reports. The fixed behavior is to zero-initialize the report buffer at allocation time. Public advisories (including AstraLinux and AlmaLinux f...

CVE-2020-0427

CVE-2020-0427 is confirmed in the connected documents as an Android kernel issue affecting the pinctrl subsystem (core.c). The vulnerability arises in create_pinctrl, where an out-of-bounds read can occur due to a use-after-free, potentially allowing local information disclosure without extra exe...

CVE-2025-26449

Google Android is susceptible to a denial-of-service vulnerability caused by uncontrolled resource consumption . An attacker can exploit this flaw to cause a local denial of service without requiring additional execution privileges or user interaction. While the provided documents confirm the vul...

CVE-2024-49728

Google Android is affected by an information disclosure vulnerability in the BluetoothOppSendFileInfo.java file within the generateFileInfo function. The root cause is a confused deputy issue, which allows for cross-user media disclosure . This vulnerability can lead to local information disclosu...

CVE-2025-26429

Google Android is vulnerable to a local denial of service (DoS) condition due to improper input validation in the collectOps function of AppOpsService.java . An attacker can exploit this flaw to cause a permanent DoS without requiring additional execution privileges or user interaction. While the...

CVE-2025-22421

A logic error in the contentDescForNotification function of NotificationContentDescription.kt within the Framework component of Google Android can lead to a notification content leak through the lockscreen. This vulnerability allows for local information disclosure without requiring additional ex...

CVE-2025-22430

A security vulnerability exists in Google Android due to a missing permission check in the isInSignificantPlace function across multiple files. This flaw allows an attacker to access sensitive information , resulting in local information disclosure . The vulnerability can be exploited without req...

CVE-2025-26437

Google Android is vulnerable to a missing permission check within the CredentialManagerServiceStub of CredentialManagerService.java . An attacker can exploit this flaw to retrieve candidate credentials, potentially leading to local information disclosure . This vulnerability does not require addi...

CVE-2025-22431

Google Android is affected by a denial of service vulnerability caused by a logic error in the code at multiple locations. A malicious app could exploit this flaw to prevent a user from dialing emergency services under specific circumstances. The impact is a local denial of service that persists ...

CVE-2025-22425

The Android Framework component is vulnerable to a local elevation of privilege due to a buffer copy flaw caused by improper input validation in the onCreate function of InstallStart.java . An attacker can exploit this flaw to escalate privileges without requiring additional execution privileges,...

CVE-2025-26456

A logic error in multiple functions of DexUseManagerLocal.java within the Android Runtime (specifically the ART Project Mainline component) allows for a local permanent denial of service . An attacker can exploit this to crash the system server without requiring additional execution privileges or...

CVE-2025-26442

The CVE-2025-26442 issue affects Android’s NotificationAccessConfirmationActivity.java (onCreate). Root cause: a logic error in the NLS int ent filter verification leading to information disclosure. Impact: local information disclosure without privilege/UI interaction. Exploitability: LOCAL, with...

CVE-2025-26432

CVE-2025-26432: A DoS vulnerability in Google Android arises from missing length checks in multiple locations, allowing local denial of service with no extra privileges and no user interaction. The issue is described across multiple CVE feeds; Android bulletin details assignability to patch level...

CVE-2025-26453

A logic error in the isContentUriForOtherUser function within BluetoothOppSendFileInfo.java on Google Android can lead to a cross-user data leak . This vulnerability allows for local information disclosure without requiring additional execution privileges or user interaction. No specific affected...

CVE-2025-26463

A denial of service vulnerability exists in Google Android due to uncontrolled resource consumption. Specifically, the allowPackageAccess function in multiple files can be triggered to exhaust resources when an attacker repeatedly adds allowed packages. This vulnerability allows for a local persi...

CVE-2024-49722

Google Android is impacted by an information disclosure vulnerability (CWE-610) within the showAvatarPicker function of EditUserPhotoController.java. The root cause is a confused deputy issue involving an obfuscated proxy, which allows for cross-user image disclosure . An attacker can exploit thi...

CVE-2025-26445

Google Android is vulnerable to a local information disclosure vulnerability due to a missing permission check in the offerNetwork function of ConnectivityService.java. An attacker can exploit this flaw to leak sensitive data without requiring additional execution privileges or user interaction. ...

CVE-2025-26448

Google Android is affected by an out-of-bounds read vulnerability in the writeToParcel function of CursorWindow.cpp . This issue is caused by the use of uninitialized data (CWE-457), which can lead to local information disclosure . Exploitation does not require additional execution privileges or ...

CVE-2020-0093

CVE-2020-0093 is a libexif vulnerability affecting Android 8.x–10, where a missing bounds check in exif_data_save_data_entry can cause an out-of-bounds read, leading to local information disclosure. The issue arises from an insufficient bounds check in exif-data.c; exploit requires user interacti...

CVE-2024-29745

CVE-2024-29745 affects Google Pixel devices in the bootloader component, with an information-disclosure flaw caused by uninitialized data. The NVD entry describes local information disclosure without extra privileges or user interaction. The Pixel Update Bulletin notes this vulnerability as poten...

CVE-2019-2228

CVE-2019-2228 describes an out-of-bounds read in cups: array_find in array.c, caused by an incorrect bounds check. This can lead to local information disclosure through the printer spooler, with no additional execution privileges required and no user interaction. The vulnerability affects multipl...

CVE-2012-6702

CVE-2012-6702 affects the Expat XML parser. Root cause: Expat may call srand or be used with a non-zero seed in XML_SetHashSalt, weakening cryptographic protections. Impact: context-dependent attackers could defeat cryptographic protections via srand-based vectors. No explicit fix in the provided...

CVE-2019-9376

CVE-2019-9376 corresponds to a DoS condition in Android (boot loop) caused by improper input validation in Account.java. Affected products per the CVE entry include Android 8.0, 8.1 and 9. The vulnerability enables local denial of service with no user interaction. Public sources in the connected ...

CVE-2020-0338

The CVE-2020-0338 entry concerns Android. In AccountManagerService.checkKeyIntent, a permission bypass could allow local information disclosure with the attacker gaining access via the device’s own user context. Public docs (NVD entry) confirm affected products as Android 9/10 with a local attack...

CVE-2019-2101

CVE-2019-2101 affects the Android kernel as described in the connected advisories. The vulnerability is caused by an out-of-bounds read in the function uvc_parse_standard_control within uvc_driver.c , resulting from improper input validation. This can lead to local information disclosure without ...

CVE-2016-5696

Technical details about CVE-2016-5696 are not publicly provided in the supplied connected documents; monitor for updates.

CVE-2020-0009

CVE-2020-0009 affects the Android kernel ashmem.c (calc_vm_may_flags): an insecure permissions bypass can allow an arbitrary write to shared memory, enabling local privilege escalation by corrupting inter-process memory. Exploitation is possible without user interaction, and no additional executi...

CVE-2023-35671

The vulnerability CVE-2023-35671 affects Android’s NFC subsystem via HostEmulationManager.java (onHostEmulationData). A logic error can allow a general-purpose NFC reader to read full card numbers and expiry data while the device is on the locked screen, enabling local information disclosure with...

CVE-2020-0419

CVE-2020-0419 involves Android’s PackageInstallerSession.java, where generateInfo can leak cross-profile URI data during app installation due to a missing permission check. The issue affects Android 8.1–11 and is described as local information disclosure with no authentication or user interaction...