Summary
Google heeft kwetsbaarheden verholpen in Android.
Samsung heeft de voor Samsung mobile devices relevante kwetsbaarheden verholpen in Samsung Mobile.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige code uit te voeren.
Onder de verholpen kwetsbaarheden zit een aantal kwetsbaarheden die door Google worden gemarkeerd als 'Critical'.
Google heeft verder, zoals gebruikelijk, weinig detailinformatie beschikbaar gesteld.
Oplossingen
Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.
Samsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices.
Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 76
-
High 8.4
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to…
KEV Jun 2, 2026 -
High 8.8
Integer Overflow or Wraparound in GPS
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
-
High 8.8
Improper Validation of Array Index in Secure Processor
Memory corruption while using Strongbox due to missing bounds check.
-
High 8.8
Buffer Copy Without Checking Size of Input in Secure Processor
Memory corruption while using Strongbox due to buffer overflow.
-
High 8.0
In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overf…
-
High 8.0
In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic erro…
-
High 7.8
In multiple locations, there is a possible way to reveal images across users due to improper input validation. This cou…
-
High 7.8
In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic er…
-
High 7.8
In multiple locations, there is a possible background activity launch due to a missing permission check. This could lea…
-
High 7.8
In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due t…
-
High 7.8
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaus…
-
High 7.8
In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypas…
-
High 7.8
In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error i…
-
High 7.8
NULL Pointer Dereference in SPS Applications
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
-
High 7.8
Out-of-bounds Write in HLOS
Memory Corruption when processing device identifier strings that exceed the expected maximum length.
-
High 7.8
NULL Pointer Dereference in HLOS
Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.
-
High 7.8CVE-2026-0009 Public exploit
In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escala…
-
High 7.8
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. Th…
-
High 7.8
In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This cou…
-
High 7.8
In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a…
-
High 7.8
In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input v…
-
High 7.8
In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app…
-
High 7.8
In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a miss…
-
High 7.8CVE-2026-0091 Public exploit
In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell …
-
High 7.8
In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to lo…
-
High 7.8
DNG SDK | Out-of-bounds Write (CWE-787)
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma…
-
High 7.8
DNG SDK | Integer Overflow or Wraparound (CWE-190)
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim mus…
-
High 7.8
Heap-Based Buffer Overflow in Power Management IC
Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
-
High 7.8
Use After Free in DSP Service
Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.
-
High 7.8
In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. Thi…
-
High 7.8
In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds…
-
High 7.6
Buffer Over-read in WLAN Firmware
Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
-
High 7.6
Buffer Over-read in WLAN Firmware
Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
-
High 7.2
Stack-based Buffer Overflow in Display
Memory Corruption when processing display command line information due to improper initialization of a variable.
-
High 7.2
Improper Validation of Syntactic Correctness of Input in Kernel
Memory corruption while processing fastboot commands with invalid input.
-
High 7.1
Buffer Over-read in Computer Vision
Cryptographic issue while copying data to a destination buffer without validating its size.
-
High 7.1CVE-2025-64720 Public exploit
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…
-
High 7.1CVE-2025-65018 Public exploit
LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…
-
Medium 6.9
Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive …
-
Medium 6.8
In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/o…
-
Medium 6.8
Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows loca…
-
Medium 6.5
Reachable Assertion in FW
Transient DOS when MAC configures config id greater than supported maximum value.
-
Medium 6.5
Buffer Over-read in WLAN HAL
Transient DOS when processing target power rate tables during channel configuration.
-
Medium 6.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an int…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper in…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.4
Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attac…
-
Medium 6.4
Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privile…
-
Medium 6.2
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tap…
-
Medium 6.2
In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC…
-
Medium 6.1
LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when process…
-
Medium 5.9
In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a…
-
Medium 5.5
In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to impr…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource e…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 5.5
In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This coul…
-
Medium 5.5
In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due…
-
Medium 5.5
In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper i…
-
Medium 5.2
Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. …
-
Medium 5.1
Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive i…
-
Medium 4.8
Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers…
-
Medium 4.6CVE-2026-21017 Public exploit
Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attac…
-
Medium 4.2
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2…
-
Low 3.3
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings acr…
-
Low 3.3
In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead…
-
Low 3.3
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. …
Revision history
-
#1.0.0
Initiele versie