Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Rechte zu erweitern, beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Denial-of-Service auszulösen und weitere nicht spezifizierte Auswirkungen zu erzielen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 34
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur while processing goodbye RTCP packet from network.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
-
High 7.8
GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
-
High 7.8
Improper Access Control in Core
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
-
High 7.8
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This i…
-
High 7.8
GPU DDK - PMMETA_PROTECT PMR can be exported as dma-buf file / GEM object
Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU drive…
-
High 7.8
Mali GPU Kernel Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain acces…
-
High 7.8
GPU DDK - _WrapExtMemReleasePages called twice if _FlushUMVirtualRange fails
Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
-
High 7.8
Use After Free in NPU
Memory corruption while calling the NPU driver APIs concurrently.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in DSP Service
Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.
-
High 7.8
Untrusted Pointer Dereference in DSP Service
Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.
-
High 7.8
GPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.
-
High 7.8
In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and moti…
-
High 7.8
In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a…
-
High 7.8
In multiple functions of NdkMediaCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This…
-
High 7.8
In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic er…
-
High 7.8
In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code…
-
High 7.8
In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified…
-
High 7.5
Buffer Over-read in WLAN HAL
Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
-
High 7.3CVE-2025-26443 Public exploit
In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from un…
-
High 7.1
GPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driv…
-
Medium 6.5
GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualised GPU memory.
-
Medium 6.5
In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead …
-
Medium 5.5
GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger a crash of the FW running on the GPU freezing graphics output.
-
Medium 5.5
In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could…
-
Medium 5.5
In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credent…
-
Medium 5.5
In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission che…
-
Medium 5.5
In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead…
-
Medium 5.5
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to l…
-
Medium 5.5
In isContentUriForOtherUser of BluetoothOppSendFileInfo.java, there is a possible cross user data leak due to a logic e…
-
Medium 5.5
In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error i…
-
Medium 5.5
In allowPackageAccess of multiple files, resource exhaustion is possible when repeatedly adding allowed packages. This …
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-27004, EUVD-2025-27006, EUVD-2025-27045, EUVD-2025-27044
-
#1
Initiale Fassung
References
-
Android Security Bulletin June 2025 vom 2025-06-02
https://source.android.com/docs/security/bulletin/2025-06-01