Platform Frameworks Base vulnerabilities

CVE-2023-20999 CVE-2023-20999: In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20996 CVE-2023-20996: In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20998 CVE-2023-20998: In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-20997 CVE-2023-20997: In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21240 CVE-2023-21240: In Policy of Policy In Policy of Policy.java, there is a possible boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21167 CVE-2023-21167: In setProfileName of DevicePolicyManagerService In setProfileName of DevicePolicyManagerService.java, there is a possible way to crash the SystemUI menu due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21111 CVE-2023-21111: In multiple functions of PhoneAccountRegistrar In multiple functions of PhoneAccountRegistrar.java, there is a possible way to prevent an access to emergency services due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48644 CVE-2025-48644: In multiple locations, there is a possible persistent denial of service due to improper input validation In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21029 CVE-2023-21029: In register of UidObserverController In register of UidObserverController.java, there is a missing permission check. This could lead to local information disclosure of app usage with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48559 CVE-2025-48559: In multiple functions of AppOpsService In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-23712 CVE-2024-23712: In multiple functions of AppOpsService In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_accesses.xml due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48562 CVE-2025-48562: In writeContent of RemotePrintDocument In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2024-40659 CVE-2024-40659: In getRegistration of RemoteProvisioningService In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48603 CVE-2025-48603: In InputMethodInfo of InputMethodInfo In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26449 CVE-2025-26449: In multiple locations, there is a possible permanent denial of service due to resource exhaustion In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26432 CVE-2025-26432: In multiple locations, there is a possible way to persistently DoS the device due to a missing length check In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26429 CVE-2025-26429: In collectOps of AppOpsService In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48551 CVE-2025-48551: In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2023-20914 CVE-2023-20914: In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils In onSetRuntimePermissionGrantStateByDeviceAdmin of AdminRestrictedPermissionsUtils.java, there is a possible way for the work profile to read SMS messages due to a permissions bypass. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20494 CVE-2022-20494: In AutomaticZenRule of AutomaticZenRule In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.