Google Android vulnerabilities

CVE-2025-0081 [HIGH] CWE-457 CVE-2025-0081: In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a cra In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2015-6634 [CRITICAL] CWE-119 CVE-2015-6634: The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261.

CVE-2020-35550 [CRITICAL] CVE-2020-35550: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypass Factory Reset Protection (FRP) via StatusBar. The Samsung ID is SVE-2020-17888 (December 2020).

CVE-2023-52342 [HIGH] CWE-248 CVE-2023-52342: In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This c In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed

CVE-2023-48398 [HIGH] CWE-125 CVE-2023-48398: In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possib In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.

CVE-2018-21066 [CRITICAL] CWE-120 CVE-2018-21066: An issue was discovered on Samsung mobile devices with M(6.0) (Exynos or MediaTek chipsets) software An issue was discovered on Samsung mobile devices with M(6.0) (Exynos or MediaTek chipsets) software. There is a buffer overflow in a Trustlet that can cause memory corruption. The Samsung ID is SVE-2018-11599 (July 2018).

CVE-2023-40104 [HIGH] CWE-295 CVE-2023-40104: In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographi In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2019-20772 [CRITICAL] CVE-2019-20772: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 softwa An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Account subsystem allows authorization bypass. The LG ID is LVE-SMP-190007 (August 2019).

CVE-2020-25049 [CRITICAL] CVE-2020-25049: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. StatusBarService An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. StatusBarService has insufficient DEX access control. The Samsung ID is SVE-2020-17797 (August 2020).

CVE-2020-25058 [CRITICAL] CVE-2020-25058: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The netwo An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The network_management service does not properly restrict configuration changes. The LG ID is LVE-SMP-200012 (July 2020).

CVE-2018-21054 [CRITICAL] CWE-190 CVE-2018-21054: An issue was discovered on Samsung mobile devices with M(6.0), N(7.x) and O(8.x) except exynos9610/9 An issue was discovered on Samsung mobile devices with M(6.0), N(7.x) and O(8.x) except exynos9610/9820 in all Platforms, M(6.0) except MSM8909 SC77xx/9830 exynos3470/5420, N(7.0) except MSM8939, N(7.1) except MSM8996 SDM6xx/M6737T software. There is an integer underflow with a resultant buffer overflow in eCryptFS. The Samsung ID is SVE-2017-1185

CVE-2020-25282 [CRITICAL] CWE-862 CVE-2020-25282: An issue was discovered on LG mobile devices with Android OS 10 software. The lguicc software (for t An issue was discovered on LG mobile devices with Android OS 10 software. The lguicc software (for the LG Universal Integrated Circuit Card) allows attackers to bypass intended access restrictions on property values. The LG ID is LVE-SMP-200020 (September 2020).

CVE-2018-14066 [CRITICAL] CWE-89 CVE-2018-14066: The content://wappush content provider in com.android.provider.telephony, as found in some custom RO The content://wappush content provider in com.android.provider.telephony, as found in some custom ROMs for Android phones, allows SQL injection. One consequence is that an application without the READ_SMS permission can read SMS messages. This affects Infinix X571 phones, as well as various Lenovo phones (such as the A7020) that have since been fix

CVE-2024-27227 [CRITICAL] CWE-787 CVE-2024-27227: A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues

CVE-2025-48630 [HIGH] CWE-208 CVE-2025-48630: In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due t In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22441 [HIGH] CWE-441 CVE-2025-22441: In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2025-48594 [HIGH] CWE-20 CVE-2025-48594: In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion appl In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2026-45528 [HIGH] CWE-926 CVE-2026-45528: In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere ch In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2026-0131 [HIGH] CWE-125 CVE-2026-0131: In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. Thi In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2022-26099 [CRITICAL] CWE-476 CVE-2022-26099: Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr- Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers.