Google Android vulnerabilities

CVE-2015-7716 [CRITICAL] CVE-2015-7716: libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than CVE-2015-3873.

CVE-2020-0377 [HIGH] CWE-125 CVE-2020-0377: In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a miss In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure in the Bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-1

CVE-2021-0431 [HIGH] CWE-125 CVE-2021-0431: In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds che In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-1741

CVE-2024-31317 [HIGH] CWE-502 CVE-2024-31317: In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as an In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21125 [HIGH] CWE-416 CVE-2023-21125: In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use a In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0095 [HIGH] CWE-190 CVE-2026-0095: In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption wi In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-45777 [HIGH] CVE-2023-45777: In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48611 [HIGH] CWE-120 CVE-2025-48611: In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds chec In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0124 [HIGH] CWE-787 CVE-2026-0124: There is a possible out of bounds write due to a missing bounds check. This could lead to local esca There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48612 [HIGH] CWE-20 CVE-2025-48612: In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set t In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32325 [HIGH] CWE-122 CVE-2025-32325: In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48623 [HIGH] CWE-787 CVE-2025-48623: In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input valid In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48638 [HIGH] CWE-787 CVE-2025-48638: In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input val In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48565 [HIGH] CVE-2025-48565: In multiple locations, there is a possible way to bypass the cross profile intent filter due to a lo In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48566 [HIGH] CWE-20 CVE-2025-48566: In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent d In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-47027 [HIGH] CWE-22 CVE-2024-47027: In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory a In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0032 [HIGH] CWE-787 CVE-2026-0032: In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48525 [HIGH] CWE-20 CVE-2025-48525: In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue read In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22424 [HIGH] CWE-20 CVE-2025-22424: In multiple locations, there is a possible way to reveal images across users due to improper input v In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2025-48613 [HIGH] CWE-269 CVE-2025-48613: In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the origin In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.