Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen oder andere nicht näher spezifizierte Angriffe durchzuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 110
-
High 8.8
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use af…
KEV Sep 4, 2025 -
High 7.8
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() …
KEV Sep 4, 2025 -
Critical 9.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity
Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
-
Critical 9.8
Improper Validation of Array Index in Multi-Mode Call Processor
Memory corruption while selecting the PLMN from SOR failed list.
-
Critical 9.1
Improper Authentication in GPS_GNSS
Cryptographic issue occurs due to use of insecure connection method while downloading.
-
High 8.8
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalatio…
-
High 8.8
In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic er…
-
High 8.8
GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation
Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.
-
High 8.4
In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in th…
-
High 8.2
GPU DDK - rgxfw_hwperf_get_packet_buffer OOB write
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
-
High 8.2
Buffer Over-read in Data HLOS - LNX
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.
-
High 8.0
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 8.0
In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after free. This could lead …
-
High 7.8
In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contact…
-
High 7.8
GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.8
In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could le…
-
High 7.8
In multiple locations, there is a possible way to hijack the Launcher app due to a logic error in the code. This could …
-
High 7.8
Mali GPU Userspace Driver allows an Out-of-Bounds access
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to …
-
High 7.8
Double Free in SPS-HLOS
Memory corruption while retrieving the CBOR data from TA.
-
High 7.8
Buffer Copy Without Checking Size of Input in HLOS
Memory corruption while performing private key encryption in trusted application.
-
High 7.8
GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.
-
High 7.8
GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driv…
-
High 7.8
In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another u…
-
High 7.8
In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic er…
-
High 7.8
Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor
memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
-
High 7.8
Incorrect Calculation of Buffer Size in Video
Memory corruption while processing video packets received from video firmware.
-
High 7.8
Buffer Copy Without Checking Size of Input in Video
Memory corruption while processing manipulated payload in video firmware.
-
High 7.8
Buffer Copy Without Checking Size of Input in Core Services
Memory corruption while processing data packets in diag received from Unix clients.
-
High 7.8
Use After Free in DSP Service
Memory corruption during sub-system restart while processing clean-up to free up resources.
-
High 7.8
Out-of-bounds Write in Video
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
-
High 7.8
In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a co…
-
High 7.8
In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive tex…
-
High 7.8CVE-2025-32324 Public exploit
In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deput…
-
High 7.8
In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to …
-
High 7.8
In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a…
-
High 7.8
In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This c…
-
High 7.8
In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error …
-
High 7.8
In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalati…
-
High 7.8
In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in t…
-
High 7.8
In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to dis…
-
High 7.8
In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a co…
-
High 7.8
In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an un…
-
High 7.8
In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to …
-
High 7.8
In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due t…
-
High 7.8
Buffer Over-read in BT Controller
Memory corruption due to global buffer overflow when a test command uses an invalid payload type.
-
High 7.8
Release of Invalid Pointer or Reference in Android Core
Memory corruption while handling invalid inputs in application info setup.
-
High 7.8
In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a log…
-
High 7.8
In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic er…
-
High 7.8
In getCallingPackageName of CredentialStorage, there is a possible permission bypass due to a logic error in the code. …
-
High 7.8
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismat…
-
High 7.8
In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the c…
-
High 7.8
In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improp…
-
High 7.8
In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could l…
-
High 7.8
In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in…
-
High 7.8
In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. …
-
High 7.8
In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to …
-
High 7.8
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device admin due to a logic e…
-
High 7.8
In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app…
-
High 7.8
In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default v…
-
High 7.5
GPU DDK - Improper locking when accessing the pvr_exp_fence object
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
-
High 7.5
Buffer Over-read in WLAN Embedded SW
Transient DOS may occur while processing malformed length field in SSID IEs.
-
High 7.5
Buffer Over-read in WLAN Embedded SW
Transient DOS while processing received beacon frame.
-
High 7.5
Improper Input Validation in Modem
Transient DOS while processing CCCH data when NW sends data with invalid length.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while handling beacon frames with invalid IE header length.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while processing a frame with malformed shared-key descriptor.
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while processing an ANQP message.
-
High 7.5
Reachable Assertion in WLAN Firmware
Transient DOS while creating NDP instance.
-
High 7.5
Buffer Over-read in BT Controller
Transient DOS while parsing the EPTM test control message to get the test pattern.
-
High 7.5
Buffer Over-read in WLAN HAL
Transient DOS while handling command data during power control processing.
-
High 7.5
Buffer Over-read in WLAN HAL
Transient DOS while processing power control requests with invalid antenna or stream values.
-
High 7.3
In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission d…
-
High 7.3
In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead…
-
High 7.3
In multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the priv…
-
High 7.3
In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper…
-
High 7.1
Cryptographic Issues in Core
Cryptographic issue while performing RSA PKCS padding decoding.
-
High 7.1
In multiple locations, there is a possible way to persistently DoS the device due to improper input validation. This co…
-
High 7.1
In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a con…
-
Medium 6.8
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr…
-
Medium 6.5
In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of …
-
Medium 6.5
Out-of-bounds Read in Core
Information disclosure while reading data from an image using specified offset and size parameters.
-
Medium 6.5
Out-of-bounds Read in Core
Information disclosure while processing the hash segment in an MBN file.
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Medium 6.2
NULL Pointer Dereference in SPS-HLOS
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
-
Medium 6.2
In multiple locations, there is a possible way to leak hidden work profile notifications due to a logic error in the co…
-
Medium 6.1
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a …
-
Medium 5.7
In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio st…
-
Medium 5.7
Possible kernel exceptions caused by reading and writing kernel heap data after free.
-
Medium 5.5
In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This …
-
Medium 5.5
In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confuse…
-
Medium 5.5
In setApplicationHiddenSettingAsUser of PackageManagerService.java, there is a possible way to hide a system critical p…
-
Medium 5.5
In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource ex…
-
Medium 5.5
In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path tra…
-
Medium 5.5
In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input va…
-
Medium 5.5
In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This coul…
-
Medium 5.5CVE-2025-48561 Public exploit
In multiple locations, there is a possible way to access data displayed on the screen due to side channel information d…
-
Medium 5.3
Mali GPU Kernel Driver allows access to already freed memory
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain acces…
-
Medium 5.2
GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.
-
Medium 5.1
An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged locat…
-
Medium 5.0
In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confuse…
-
Medium 5.0
In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error. This coul…
-
Medium 4.3
GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.
-
Medium 4.0
In createMultiProfilePagerAdapter of ChooserActivity.java , there is a possible way for an app to launch the ChooserAct…
-
Medium 4.0
In multiple locations, there is a possible way to overlay biometrics due to a tapjacking/overlay attack. This could lea…
-
Low 3.3
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission chec…
-
Unscored —CVE-2025-21755 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Revision history
-
#4
Referenz(en) aufgenommen: EUVD-2025-30987, EUVD-2025-31000, EUVD-2025-30999, EUVD-2025-30998, EUVD-2025-30994, EUVD-2025-30996, EUVD-2025-31001, EUVD-2025-31002, EUVD-2025-30982, EUVD-2025-30983, EUVD-2025-30985, EUVD-2025-30986, EUVD-2025-31003
-
#3
Referenz(en) aufgenommen: EUVD-2025-27124
-
#2
Referenz(en) aufgenommen: EUVD-2025-26818, EUVD-2025-26819, EUVD-2025-26822, EUVD-2025-26823, EUVD-2025-26824, EUVD-2025-26825, EUVD-2025-26826, EUVD-2025-26828, EUVD-2025-26829, EUVD-2025-26830, EUVD-2025-26831, EUVD-2025-26834, EUVD-2025-26835, EUVD-2025-26836, EUVD-2025-26837, EUVD-2025-26796, EUVD-2025-26804, EUVD-2025-26805, EUVD-2025-26806, EUVD-2025-26807, EUVD-2025-26808, EUVD-2025-26811, EUVD-2025-26814, EUVD-2025-26815, EUVD-2025-26816, EUVD-2025-26827, EUVD-2025-26832, EUVD-2025-26795, EUVD-2025-26833, EUVD-2025-26803, EUVD-2025-26809, EUVD-2025-26799, EUVD-2025-26800, EUVD-2025-26810, EUVD-2025-26812, EUVD-2025-26813, EUVD-2025-26817, EUVD-2025-26791, EUVD-2025-26797, EUVD-2025-26798, EUVD-2025-26801, EUVD-2025-26802, EUVD-2024-54966, EUVD-2025-26792, EUVD-2025-26793, EUVD-2025-26794, EUVD-2025-26838, EUVD-2025-26839, EUVD-2025-26840, EUVD-2025-26841, EUVD-2025-26842, EUVD-2025-26843, EUVD-2025-26844, EUVD-2025-26845, EUVD-2025-26846, EUVD-2025-26820, EUVD-2025-26821
-
#1
Initiale Fassung
References
-
Sicherheitsbulletin für Android – September 2025 vom 2025-09-02
https://source.android.com/docs/security/bulletin/2025-09-01