Summary
Google heeft kwetsbaarheden verholpen in Android.
Samsung heeft de voor Samsung Mobile relevante kwetsbaarheden verholpen in hun producten.
Details
Interpretaties
De ernstige kwetsbaarheden betreffen onder andere mogelijkheden voor het uitvoeren van willekeurige code op afstand (Remote Code Execution) en het verkrijgen van verhoogde systeemrechten (Privilege Escalation). Hierdoor kunnen aanvallers ongeautoriseerde toegang krijgen tot systeemonderdelen en de controle over het apparaat verkrijgen. Er zijn op dit moment geen berichten bekend over actief misbruik van deze kwetsbaarheden.
Oplossingen
Google heeft beveiligingsupdates uitgebracht om de kwetsbaarheden in Android-versies 14, 15, 16 en 17 te verhelpen.
Samsung heeft daarnaast beveiligingsupdates beschikbaar gesteld om de relevante kwetsbaarheden in Samsung Galaxy-apparaten te verhelpen.
Raadpleeg de onderstaande referenties voor meer informatie en de beschikbare beveiligingsupdates.
Vulnerabilities 206
-
Critical 9.8
GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unint…
-
Critical 9.8
tls: Fix race condition in tls_sw_cancel_work_tx()
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can s…
-
Critical 9.8
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto re…
-
Critical 9.8CVE-2026-58868 Public exploit
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This co…
-
Critical 9.8
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code …
-
Critical 9.8
In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote c…
-
Critical 9.8
In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to rem…
-
Critical 9.8
GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB
On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is limited which causes errors when the mapping outside of that range. Integer truncation caused when mapping GPU buffer pages in the buffer’s…
-
High 8.8
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of…
-
High 8.8
xfrm: esp: avoid in-place decrypt on shared skb frags
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…
-
High 8.8
HID: core: Fix OOB read in hid_get_report for numbered reports
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid_get_report for numbered reports When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report(…
-
High 8.8
Bluetooth: SCO: hold sk properly in sco_conn_ready
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is…
-
High 8.4
In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/ov…
-
High 8.4
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay …
-
High 8.4
In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to i…
-
High 8.4
In Video HAL, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escal…
-
High 8.4
In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
High 8.4
In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
High 8.4
In apu, there is a possible memory corruption due to improper input validation. This could lead to local escalation of …
-
High 8.4
In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of …
-
High 8.4
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation…
-
High 8.4
In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due t…
-
High 8.4
In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper in…
-
High 8.4
In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improp…
-
High 8.4
In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic er…
-
High 8.4
In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confu…
-
High 8.4
In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in th…
-
High 8.4
In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused de…
-
High 8.4
In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This…
-
High 8.4
In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing pe…
-
High 8.4
In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy d…
-
High 8.4
In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent action…
-
High 8.4
In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a co…
-
High 8.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation…
-
High 8.4
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escal…
-
High 8.4
In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account…
-
High 8.4
In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. T…
-
High 8.4
In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused de…
-
High 8.4
In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could…
-
High 8.4
In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead t…
-
High 8.4
In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local esca…
-
High 8.4
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to loca…
-
High 8.4
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local e…
-
High 8.4
In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to lo…
-
High 8.4
In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead…
-
High 8.4
In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead t…
-
High 8.4
In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local esc…
-
High 8.4
In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead…
-
High 8.4
In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI iss…
-
High 8.4
In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. Th…
-
High 8.4
In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. …
-
High 8.4
In descramble of multiple files, there is a possible out-of-bounds write due to improper casting. This could lead to lo…
-
High 8.4
In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.…
-
High 8.4
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 8.4
In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error…
-
High 8.4
In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to…
-
High 8.4
In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy. This could …
-
High 8.4
In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) is…
-
High 8.4
In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the cod…
-
High 8.4
In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This coul…
-
High 8.4
In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to …
-
High 8.4
In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background activity launch due to a lo…
-
High 8.4
In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing per…
-
High 8.4
In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. Th…
-
High 8.4
In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. Th…
-
High 8.4
In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This cou…
-
High 8.4
In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This …
-
High 8.4
In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to loca…
-
High 8.4
In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local …
-
High 8.4
In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. T…
-
High 8.4
In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalati…
-
High 8.4
In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a miss…
-
High 8.4
In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission …
-
High 8.4
In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This…
-
High 8.4
In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could…
-
High 8.4
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 8.4
In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local esc…
-
High 8.4
In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check.…
-
High 8.4
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local esc…
-
High 8.4
In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This co…
-
High 8.4
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.…
-
High 8.4
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local es…
-
High 8.4
Out-of-bounds Write in Bootloader
Memory Corruption when processing firmware update data in Download mode due to a missing bounds check.
-
High 8.3
Stack-based Buffer Overflow in Modem
In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.
-
High 8.1
GPU DDK - UAF read of GLES3Context::psDrawParams and GLES3Context::psMode and UAF read/write of RMJob::apsCCBs
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger a write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this …
-
High 8.1
HID: playstation: Clamp num_touch_reports
In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device would never lie about the number of touch reports would it? If it does the loop in dualshock4_parse_report will read off the end of the touc…
-
High 8.1
In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote …
-
High 8.0
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock, but returns the selected listener after dropping that lo…
-
High 7.9
In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a…
-
High 7.9
An information leakage vulnerability in the TCG TPM 2.0 reference code.
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS aut…
-
High 7.8
In multiple locations, there is a possible way to reveal images across users due to improper input validation. This cou…
-
High 7.8
In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic er…
-
High 7.8
f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the …
-
High 7.8
In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privil…
-
High 7.8
binder: fix UAF in binder_netlink_report()
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_netlink_report() Oneway transactions sent to frozen targets via binder_proc_transaction() return a BR_TRANSACTION_PENDING_FROZEN error but they are still treated as …
-
High 7.8
Use After Free in Graphics
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
-
High 7.8
In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds…
-
High 7.8CVE-2026-43499 Public exploit
rtmutex: Use waiter::task instead of current in remove_waiter()
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when …
-
High 7.8
GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result…
-
High 7.8
GPU DDK - Incorrect page size validation in PhysmemNewRamBackedPMR could lead to OOB read and/or write of arbitrary physical memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading to OOB read and/or write due to improper validation of the said value. Such crafted log2 page size …
-
High 7.8CVE-2026-46242 Public exploit
eventpoll: fix ep_remove struct eventpoll / struct file UAF
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_…
-
High 7.8
In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input valid…
-
High 7.8
Use After Free in DSP Service
Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
-
High 7.8
Untrusted Pointer Dereference in Graphics
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
-
High 7.8
Use After Free in DSP Service
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
-
High 7.8
In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass v…
-
High 7.8
In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This…
-
High 7.8
nfc: llcp: Fix use-after-free in llcp_sock_release()
In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, i…
-
High 7.8CVE-2026-64560 Public exploit
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() po…
-
High 7.8
Mali GPU Userspace Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via We…
-
High 7.7
Mali GPU Kernel Driver allows denial of service or disclosure of sensitive information
A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to cause…
-
High 7.5
GPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can lead memory allocation failure. If the allocation failure is not properly handled, the compiler may dereference a NULL pointer at a controlled offset, resulting i…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalatio…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of p…
-
High 7.5
In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalatio…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.5
Buffer Over-read in WLAN HAL
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
-
High 7.5
In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lea…
-
High 7.5
In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check. This cou…
-
High 7.5CVE-2026-58882 Public exploit
In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could l…
-
High 7.5
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to remot…
-
High 7.5
In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could…
-
High 7.5
In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overf…
-
High 7.5
In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remot…
-
High 7.5
Improper Input Validation in Modem Firmware
Transient DOS when processing a malformed NR RRC configuration message due to improper input validation.
-
High 7.4
In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to…
-
High 7.4
In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. …
-
High 7.4
In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalati…
-
High 7.1
GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet
Software installed and run as a non-privileged user may conduct improper system calls to allocate physical memory. A 32-bit integer overflow in the KM driver during page-to-byte conversion of an allocation size can result in an undersized kernel buffer alloca…
-
High 7.1
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.1
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privi…
-
High 7.1
Improper Verification of Cryptographic Signature in Boot
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
-
High 7.1
GPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM
Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in use, replace with another allocation and cause arbitrary memory reads or writes to physical memory pages. A memory buffer managed by a CPU thr…
-
High 7.0CVE-2025-22442 Public exploit
In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications …
-
High 7.0
GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lea…
-
Medium 6.8
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
Medium 6.8
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a lo…
-
Medium 6.8
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physi…
-
Medium 6.7
In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privileg…
-
Medium 6.7
In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This c…
-
Medium 6.2
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of …
-
Medium 6.2
In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to loca…
-
Medium 6.2
In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to r…
-
Medium 6.2
In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This…
-
Medium 6.2
In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improp…
-
Medium 6.2
In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL in…
-
Medium 6.2
In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local…
-
Medium 6.2
In multiple locations, there is a possible persistent denial of service due to improper input validation. This could le…
-
Medium 6.2
In updateNotificationChannel of PreferencesHelper.java, there is a possible ui obfuscation issue due to a logic error i…
-
Medium 6.2
In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code…
-
Medium 6.2
In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource…
-
Medium 6.2
In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to lo…
-
Medium 6.2
In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local…
-
Medium 6.2
In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in t…
-
Medium 6.2
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input vali…
-
Medium 6.2
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local…
-
Medium 5.9
In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. Th…
-
Medium 5.5
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This c…
-
Medium 5.5
GPU DDK - SharedSecMem mapped into all GPU virtual address spaces
An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secure memory allocations in the kernel module. Additionally, an attacker could disrupt the operation of another secure GPU process leading to i…
-
Medium 5.5
GPU DDK - Out of bounds memory access and kernel NULL pointer dereference in DmaTransfer when pui64Address is a pointer to device memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of ex…
-
Medium 5.5
GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change
A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software writes data past the end of an int…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 5.3
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of se…
-
Medium 5.3
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of se…
-
Medium 5.3
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of…
-
Medium 5.3
In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to r…
-
Medium 5.3
In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lea…
-
Medium 5.3
In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to…
-
Medium 5.3
In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This…
-
Medium 5.3
In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. T…
-
Medium 5.1
Mali GPU Userspace Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to access already freed…
-
Medium 4.3
In multiple locations, there is a possible side channel information leak due to improperly used crypto. This could lead…
-
Medium 4.0
In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check.…
-
Medium 4.0
In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This co…
-
Medium 4.0
In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due…
-
Medium 4.0
In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path t…
-
Medium 4.0
In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused dep…
-
Medium 4.0
In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. Thi…
-
Medium 4.0
In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permiss…
-
Medium 4.0
In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused dep…
-
Medium 4.0
In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to loca…
-
Medium 4.0
In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission ch…
-
Medium 4.0
In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead…
-
Medium 4.0
In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code…
-
Medium 4.0
In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead …
-
Medium 4.0
In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This co…
-
Medium 4.0
In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the co…
-
Medium 4.0
In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a miss…
-
Medium 4.0
In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. …
-
Medium 4.0
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local…
-
Medium 4.0
In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a mi…
-
Medium 4.0
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local informa…
-
Medium 4.0
In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. Th…
-
Medium 4.0
In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to …
-
Low 3.3
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. …
-
Low 2.4
In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. Thi…
-
Unscored —
HID: logitech-dj: Fix maxfield check in DJ short report validation
In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e ("HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write") added validation for t…
Revision history
-
#1.0.0
Initiele versie