Google Android vulnerabilities

CVE-2018-9556 [CRITICAL] CWE-190 CVE-2018-9556: In ParsePayloadHeader of payload_metadata.cc, there is a possible out of bounds write due to an inte In ParsePayloadHeader of payload_metadata.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113118184.

CVE-2026-55343 [HIGH] CWE-120 CVE-2026-55343: In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bo In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2019-2046 [CRITICAL] CWE-190 CVE-2019-2046: In CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to an In CalculateInstanceSizeForDerivedClass of objects.cc, there is possible memory corruption due to an integer overflow. This could lead to remote code execution in the proxy auto-config with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 An

CVE-2021-39708 [CRITICAL] CWE-787 CVE-2021-39708: In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to an incorr In gatt_process_notification of gatt_cl.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-206128341

CVE-2021-25387 [CRITICAL] CWE-122 CVE-2021-25387: An improper input validation vulnerability in sflacfd_get_frm() in libsflacextractor library prior t An improper input validation vulnerability in sflacfd_get_frm() in libsflacextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on mediaextractor process.

CVE-2019-9365 [CRITICAL] CWE-502 CVE-2019-9365: In Bluetooth, there is a possible deserialization error due to missing string validation. This could In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537

CVE-2023-21228 [CRITICAL] CVE-2023-21228: In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21218 [CRITICAL] CVE-2023-21218: In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21263 [CRITICAL] CVE-2023-21263: In OSMMapPMRGeneric of pmr_os.c, there is a possible out of bounds write due to an uncaught excep In OSMMapPMRGeneric of pmr_os.c, there is a possible out of bounds write due to an uncaught exception. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-20083 [CRITICAL] CWE-787 CVE-2024-20083: In venc, there is a possible out of bounds write due to a missing bounds check. This could lead to l In venc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08810810 / ALPS08805789; Issue ID: MSV-1502.

CVE-2024-20078 [CRITICAL] CWE-843 CVE-2024-20078: In venc, there is a possible out of bounds write due to type confusion. This could lead to local esc In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08737250; Issue ID: MSV-1452.

CVE-2025-22435 [CRITICAL] CWE-843 CVE-2025-22435: In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This co In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2014-7224 [HIGH] CWE-20 CVE-2014-7224: A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterfac A Code Execution vulnerability exists in Android prior to 4.4.0 related to the addJavascriptInterface method and the accessibility and accessibilityTraversal objects, which could let a remote malicious user execute arbitrary code.

CVE-2026-0106 [CRITICAL] CWE-119 CVE-2026-0106: In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9472 [HIGH] CWE-190 CVE-2018-9472: In xmlMemStrdupLoc of xmlmemory.c, there is a possible out-of-bounds write due to an integer overflo In xmlMemStrdupLoc of xmlmemory.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2018-9365 [HIGH] CWE-125 CVE-2018-9365: In smp_data_received of smp_l2c.cc, there is a possible out of bounds read followed by code executio In smp_data_received of smp_l2c.cc, there is a possible out of bounds read followed by code execution due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2018-9433 [HIGH] CWE-116 CVE-2018-9433: In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2017-7375 [CRITICAL] CWE-611 CVE-2017-7375: A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the calle A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expo

CVE-2025-48530 [HIGH] CWE-125 CVE-2025-48530: In multiple locations, there is a possible condition that results in OOB accesses due to an incorrec In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2015-3826 [MEDIUM] CWE-119 CVE-2015-3826: The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android be The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to cause a denial of service (integer underflow, buffer over-read, and mediaserver process crash) via crafted 3GPP met