Google Android vulnerabilities

CVE-2014-0900 [HIGH] CWE-20 CVE-2014-0900: The Device Administrator code in Android before 4.4.1_r1 might allow attackers to spoof device admin The Device Administrator code in Android before 4.4.1_r1 might allow attackers to spoof device administrators and consequently bypass MDM restrictions by leveraging failure to update the mAdminMap data structure.

CVE-2019-2225 [HIGH] CWE-269 CVE-2019-2225: When pairing with a Bluetooth device, it may be possible to pair a malicious device without any conf When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to interact with the phone. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: And

CVE-2021-39772 [HIGH] CWE-269 CVE-2021-39772: In Bluetooth, there is a possible way to access the a2dp audio control switch due to a missing permi In Bluetooth, there is a possible way to access the a2dp audio control switch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-181962322

CVE-2022-20254 [HIGH] CVE-2022-20254: In Wi-Fi, there is a permissions bypass. This could lead to local escalation of privilege from the g In Wi-Fi, there is a permissions bypass. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-223377547

CVE-2025-36901 [HIGH] CWE-269 CVE-2025-36901: WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-39646 WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223.

CVE-2023-21115 [HIGH] CWE-327 CVE-2023-21115: In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due In btm_sec_encrypt_change of btm_sec.cc, there is a possible way to downgrade the link key type due to improperly used crypto. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-2

CVE-2019-2201 [HIGH] CWE-787 CVE-2019-2201: In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds writ In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 An

CVE-2015-6575 [CRITICAL] CVE-2015-6575: SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data, aka internal bug 20139950, a different vulnerability than CVE-2015-1538. NOTE: this vulnerab

CVE-2015-8072 [CRITICAL] CVE-2015-8072: mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote a mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.

CVE-2025-48581 [HIGH] CWE-754 CVE-2025-48581: In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22406 [HIGH] CWE-416 CVE-2025-22406: In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due t In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-29746 [HIGH] CWE-787 CVE-2024-29746: In lpm_req_handler of lpm.c, there is a possible out of bounds write due to improper input validatio In lpm_req_handler of lpm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-27209 [HIGH] CWE-122 CVE-2024-27209: there is a possible out of bounds write due to a heap buffer overflow. This could lead to local esca there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36899 [HIGH] CWE-489 CVE-2025-36899: There is a possible escalation of privilege due to test/debugging code left in a production build. T There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-56191 [HIGH] CWE-281 CVE-2024-56191: In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow. T In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2020-0458 [HIGH] CWE-190 CVE-2020-0458: In SPDIFEncoder::writeBurstBufferBytes and related methods of SPDIFEncoder.cpp, there is a possible In SPDIFEncoder::writeBurstBufferBytes and related methods of SPDIFEncoder.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-8.0 Android-8.1Andro

CVE-2020-0377 [HIGH] CWE-125 CVE-2020-0377: In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a miss In gatt_process_read_by_type_rsp of gatt_cl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure in the Bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-1

CVE-2024-20146 [HIGH] CWE-787 CVE-2024-20146: In wlan STA driver, there is a possible out of bounds write due to improper input validation. This c In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389496 / ALPS09137491; Issue ID: MSV-1835.

CVE-2017-0807 [CRITICAL] CVE-2017-0807: An elevation of privilege vulnerability in the Android framework (ui framework). Product: Android. V An elevation of privilege vulnerability in the Android framework (ui framework). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35056974.

CVE-2023-21125 [HIGH] CWE-416 CVE-2023-21125: In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use a In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.