Google Android vulnerabilities

CVE-2022-20469 [HIGH] CWE-787 CVE-2022-20469: In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing b In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-1

CVE-2021-0965 [HIGH] CWE-862 CVE-2021-0965: In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android

CVE-2026-0007 [HIGH] CWE-1021 CVE-2026-0007: In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permiss In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2015-6608 [CRITICAL] CWE-119 CVE-2015-6608: mediaserver in Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to mediaserver in Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 19779574, 23680780, 23876444, and 23658148, a different vulnerability than CVE-2015-8072 and CVE-2015-8073.

CVE-2015-6609 [CRITICAL] CWE-119 CVE-2015-6609: libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.

CVE-2026-0037 [HIGH] CWE-787 CVE-2026-0037: In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the co In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0047 [HIGH] CWE-280 CVE-2026-0047: In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access pri In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48650 [HIGH] CWE-89 CVE-2025-48650: In multiple locations, there is a possible information disclosure due to SQL injection. This could l In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-27213 [HIGH] CWE-416 CVE-2024-27213: In BroadcastSystemMessage of servicemgr.cpp, there is a possible Remote Code Execution due to a use In BroadcastSystemMessage of servicemgr.cpp, there is a possible Remote Code Execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48582 [HIGH] CWE-59 CVE-2025-48582: In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE p In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0029 [HIGH] CWE-269 CVE-2026-0029: In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48619 [HIGH] CWE-284 CVE-2025-48619: In multiple functions of ContentProvider.java, there is a possible way for an app with read-only acc In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-27700 [HIGH] CWE-693 CVE-2025-27700: There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56978 [HIGH] CWE-120 CVE-2026-56978: In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing boun In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58699 [HIGH] CWE-125 CVE-2026-58699: In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56986 [HIGH] CWE-441 CVE-2026-56986: In multiple files, there is a possible out-of-bounds read due to type confusion. This could lead to In multiple files, there is a possible out-of-bounds read due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-22005 [HIGH] CWE-787 CVE-2024-22005: there is a possible Authentication Bypass due to improperly used crypto. This could lead to local es there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0118 [HIGH] CWE-693 CVE-2026-0118: In oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could le In oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0117 [HIGH] CWE-787 CVE-2026-0117: In mfc_dec_dqbuf of mfc_dec_v4l2.c, there is a possible out of bounds write due to an incorrect boun In mfc_dec_dqbuf of mfc_dec_v4l2.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0107 [HIGH] CWE-441 CVE-2026-0107: In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.