Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um erhöhte Privilegien zu erlangen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen preiszugeben oder andere nicht spezifizierte Angriffe auszuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 46
-
High 8.1
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…
KEV May 6, 2025 -
High 8.8
In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to In…
-
High 8.2
Buffer Over-read in Multi-Mode Call Processor
Memory corruption while decoding of OTA messages from T3448 IE.
-
High 7.9
GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data into another Guest's virtualised GPU memory.
-
High 7.8
In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity…
-
High 7.8CVE-2024-34739 Public exploit
In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a…
-
High 7.8
Use After Free in DSP Service
Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.
-
High 7.8
GPU DDK - Arbitrary write of read-only dmabuf
Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers.
-
High 7.8
GPU DDK - Exploitable double free on PTL_STREAM_DESC object in the kernel function TLServerCloseStreamKM due to a race condition
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes
Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory.
-
High 7.8
Out-of-bounds Write in SPS Applications
Memory corruption while reading secure file.
-
High 7.8
Detection of Error Condition Without Action in Hypervisor
Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
-
High 7.8
Improper Access Control in Hypervisor
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
-
High 7.8
Improper Input Validation in HLOS
Memory corruption during the FRS UDS generation process.
-
High 7.8
GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory. This …
-
High 7.8
Mali GPU Kernel Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to gain access to al…
-
High 7.8
Use After Free in GPS HLOS Driver
Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
-
High 7.8
Out-of-bounds Write in Computer Vision
Memory corruption while reading the FW response from the shared queue.
-
High 7.8
Out-of-bounds Write in Computer Vision
Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.
-
High 7.8
In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the…
-
High 7.8
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to dis…
-
High 7.8
In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an acti…
-
High 7.8
In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a perm…
-
High 7.8
In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly …
-
High 7.5
Buffer Over-read in Multi-Mode Call Processor
Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing per STA profile in ML IE.
-
High 7.3
GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
Medium 6.5
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 6.2
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a m…
-
Medium 5.5
In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. T…
-
Medium 5.5
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent…
-
Medium 5.1CVE-2025-0087 Public exploit
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing p…
-
Medium 5.1
In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could l…
-
Medium 5.1
In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant f…
-
Medium 4.4
In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the in…
-
Medium 4.4
In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local …
-
Medium 4.0
In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead t…
-
Medium 4.0
In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This could lead t…
-
Medium 4.0
In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This coul…
-
Medium 4.0
In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to loca…
-
Medium 4.0
In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to…
-
Medium 4.0
In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. Th…
-
Medium 4.0
In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error …
-
Low 3.3
GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
Low 3.2
In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the cod…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-26860, EUVD-2025-26861, EUVD-2025-26864, EUVD-2023-39657, EUVD-2024-54967, EUVD-2025-26865, EUVD-2025-26867, EUVD-2025-26862, EUVD-2025-26863, EUVD-2025-26853, EUVD-2025-26854, EUVD-2025-26855, EUVD-2025-26856, EUVD-2025-26859, EUVD-2025-26857, EUVD-2025-26858
-
#1
Initiale Fassung
References
-
Android Patchday Mai 2025 vom 2025-05-05
https://source.android.com/docs/security/bulletin/2025-05-01