Google Android vulnerabilities

CVE-2019-9291 [HIGH] CWE-770 CVE-2019-9291: In Bluetooth, there is a possible remote code execution due to an improper memory allocation. This c In Bluetooth, there is a possible remote code execution due to an improper memory allocation. This could lead to remote code execution in Bluetooth with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112159179

CVE-2019-2063 [HIGH] CWE-787 CVE-2019-2063: In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead t In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116019594

CVE-2021-0557 [HIGH] CWE-190 CVE-2021-0557: In setRange of ABuffer.cpp, there is a possible out of bounds write due to an integer overflow. This In setRange of ABuffer.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-179046129

CVE-2017-13256 [HIGH] CWE-787 CVE-2017-13256: In process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missin In process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68817966.

CVE-2021-0473 [HIGH] CWE-908 CVE-2021-0473: In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. Thi In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-179687208

CVE-2023-21127 [HIGH] CWE-908 CVE-2023-21127: In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitiali In readSampleData of NuMediaExtractor.cpp, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-275418191

CVE-2023-40087 [HIGH] CWE-787 CVE-2023-40087: In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-35658 [HIGH] CWE-416 CVE-2023-35658: In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2015-3836 [CRITICAL] CWE-189 CVE-2015-3836: The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Andr The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860.

CVE-2026-0013 [HIGH] CWE-441 CVE-2026-0013: In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48605 [HIGH] CWE-693 CVE-2025-48605: In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a l In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48602 [HIGH] CWE-693 CVE-2025-48602: In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possib In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0021 [HIGH] CWE-441 CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permissi In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58691 [HIGH] CWE-20 CVE-2026-58691: In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. T In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0194 [HIGH] CWE-190 CVE-2026-0194: In multiple locations, there is a possible permission bypass due to an integer overflow. This could In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36920 [HIGH] CWE-20 CVE-2025-36920: In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to impr In hyp_alloc of arch/arm64/kvm/hyp/nvhe/alloc.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2016-2506 [CRITICAL] CWE-119 CVE-2016-2506: DRMExtractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5 DRMExtractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate a certain offset value, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28175045.

CVE-2025-36923 [HIGH] CWE-122 CVE-2025-36923: In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0097 [HIGH] CWE-693 CVE-2026-0097: In multiple locations, there is a possible way to bypass user interaction when pairing an LE device In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0059 [HIGH] CWE-122 CVE-2026-0059: In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.