Google Android vulnerabilities

CVE-2021-0303 [HIGH] CWE-362 CVE-2021-0303: In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObse In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Android

CVE-2021-39629 [HIGH] CWE-362 CVE-2021-39629: In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a ra In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-197353344

CVE-2021-0432 [HIGH] CWE-362 CVE-2021-0432: In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possi In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173552790

CVE-2023-40131 [HIGH] CWE-416 CVE-2023-40131: In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This co In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-20779 [HIGH] CWE-416 CVE-2025-20779: In display, there is a possible use after free due to a race condition. This could lead to local esc In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184084; Issue ID: MSV-4720.

CVE-2021-0650 [MEDIUM] CWE-125 CVE-2021-0650: In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrec In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-190286685

CVE-2020-0411 [MEDIUM] CWE-787 CVE-2020-0411: In ~AACExtractor() of AACExtractor.cpp, there is a possible out of bounds write due to uninitialized In ~AACExtractor() of AACExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-142641801

CVE-2020-0213 [MEDIUM] CWE-787 CVE-2020-0213: In hevcd_fmt_conv_420sp_to_420sp_av8 of ihevcd_fmt_conv_420sp_to_420sp.s, there is a possible out of In hevcd_fmt_conv_420sp_to_420sp_av8 of ihevcd_fmt_conv_420sp_to_420sp.s, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10 Android-11 Android ID: A-143

CVE-2020-0450 [MEDIUM] CWE-125 CVE-2020-0450: In rw_i93_sm_format of rw_i93.cc, there is a possible out of bounds read due to uninitialized data. In rw_i93_sm_format of rw_i93.cc, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-157650336

CVE-2026-0048 [MEDIUM] CWE-269 CVE-2026-0048: In hide of WindowState.java, there is a possible way to trick the user into approving permissions du In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-47339 [MEDIUM] CWE-862 CVE-2022-47339: In cmd services, there is a OS command injection issue due to missing permission check. This could l In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.

CVE-2021-0378 [MEDIUM] CWE-125 CVE-2021-0378: In getNbits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overfl In getNbits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154076193

CVE-2021-0379 [MEDIUM] CWE-125 CVE-2021-0379: In getUpTo17bits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer o In getUpTo17bits of pvmp3_getbits.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154075955

CVE-2021-0558 [MEDIUM] CWE-125 CVE-2021-0558: In fillMainDataBuf of pvmp3_framedecoder.cpp, there is a possible out of bounds read due to a heap b In fillMainDataBuf of pvmp3_framedecoder.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173473906

CVE-2021-39665 [MEDIUM] CWE-787 CVE-2021-39665: In checkSpsUpdated of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer In checkSpsUpdated of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-204077881

CVE-2022-20202 [MEDIUM] CWE-787 CVE-2022-20202: In ih264_resi_trans_quant_4x4_sse42 of ih264_resi_trans_quant_sse42.c, there is a possible out of bo In ih264_resi_trans_quant_4x4_sse42 of ih264_resi_trans_quant_sse42.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-204704614

CVE-2026-0027 [MEDIUM] CWE-416 CVE-2026-0027: In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-23432 [MEDIUM] CWE-20 CVE-2022-23432: An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 a An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.

CVE-2022-23431 [MEDIUM] CWE-120 CVE-2022-23431: An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory writ An improper boundary check in RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.

CVE-2021-25518 [MEDIUM] CWE-119 CVE-2021-25518: An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arb An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arbitrary memory write and code execution.