Google Android vulnerabilities

CVE-2023-21314 [MEDIUM] CWE-125 CVE-2023-21314: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20798 [MEDIUM] CWE-125 CVE-2023-20798: In pda, there is a possible out of bounds read due to an incorrect calculation of buffer size. This In pda, there is a possible out of bounds read due to an incorrect calculation of buffer size. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07147572; Issue ID: ALPS07421076.

CVE-2024-29755 [MEDIUM] CWE-125 CVE-2024-29755: In tmu_get_pi of tmu.c, there is a possible out of bounds read due to improper input validation. Thi In tmu_get_pi of tmu.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20813 [MEDIUM] CWE-125 CVE-2023-20813: In wlan service, there is a possible out of bounds read due to improper input validation. This could In wlan service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07453549; Issue ID: ALPS07453549.

CVE-2023-20818 [MEDIUM] CWE-125 CVE-2023-20818: In wlan service, there is a possible out of bounds read due to improper input validation. This could In wlan service, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07460540; Issue ID: ALPS07460540.

CVE-2023-52346 [MEDIUM] CWE-120 CVE-2023-52346: In modem driver, there is a possible system crash due to improper input validation. This could lead In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed

CVE-2023-21357 [MEDIUM] CWE-125 CVE-2023-21357: In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to loc In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-35653 [MEDIUM] CWE-863 CVE-2023-35653: In TBD of TBD, there is a possible way to access location information due to a permissions bypass. T In TBD of TBD, there is a possible way to access location information due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20790 [MEDIUM] CWE-787 CVE-2023-20790: In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to In nvram, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07740194; Issue ID: ALPS07740194.

CVE-2024-20036 [MEDIUM] CWE-284 CVE-2024-20036: In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508.

CVE-2023-52535 [MEDIUM] CWE-20 CVE-2023-52535: In vsp driver, there is a possible missing verification incorrect input. This could lead to local de In vsp driver, there is a possible missing verification incorrect input. This could lead to local denial of service with no additional execution privileges needed

CVE-2025-20789 [MEDIUM] CWE-201 CVE-2025-20789: In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could le In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.

CVE-2026-20424 [MEDIUM] CWE-125 CVE-2026-20424: In display, there is a possible out of bounds read due to a missing bounds check. This could lead to In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5540.

CVE-2026-20429 [MEDIUM] CWE-125 CVE-2026-20429: In display, there is a possible out of bounds read due to a missing bounds check. This could lead to In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10320471; Issue ID: MSV-5535.

CVE-2022-42768 [MEDIUM] CWE-126 CVE-2022-42768: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.

CVE-2025-20638 [MEDIUM] CWE-457 CVE-2025-20638: In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lea In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291449; Issue ID: MSV-2066.

CVE-2024-20026 [MEDIUM] CVE-2024-20026: In da, there is a possible information disclosure due to improper input validation. This could lead In da, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541632.

CVE-2023-20620 [MEDIUM] CWE-367 CVE-2023-20620: In adsp, there is a possible escalation of privilege due to a logic error. This could lead to local In adsp, there is a possible escalation of privilege due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07554558; Issue ID: ALPS07554558.

CVE-2021-25391 [MEDIUM] CWE-926 CVE-2021-25391: Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers t Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.

CVE-2021-25390 [MEDIUM] CWE-926 CVE-2021-25390: Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to e Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.