Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, einen Denial-of-Service-Zustand auszulösen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 107
-
High 7.8CVE-2025-48572 Exploited
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. Th…
KEV Dec 2, 2025 -
Medium 5.5CVE-2025-48633 Exploited
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisi…
KEV Dec 2, 2025 -
Critical 9.8
GPU DDK - RGXFW_CTL.pui8FWScratchBuf Leak/Overwrite
Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE).
-
Critical 9.0
Buffer Copy Without Checking Size of Input in Boot
Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.
-
High 8.8
Incorrect Calculation of Buffer Size in SCE-Mink
Memory corruption while processing a GP command response.
-
High 8.8
In multiple locations, there is a possible way to launch an application from the background due to a precondition check…
-
High 8.1
In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation o…
-
High 7.8CVE-2023-40130 Public exploit
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. T…
-
High 7.8
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This …
-
High 7.8
Incorrect Calculation of Buffer Size in HLOS
Memory corruption during PlayReady APP usecase while processing TA commands.
-
High 7.8
Out-of-bounds Write in Display
Memory corruption while processing a malformed license file during reboot.
-
High 7.8
Out-of-bounds Write in Windows Compute
Memory corruption while performing encryption and decryption commands.
-
High 7.8
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the devi…
-
High 7.8
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the devi…
-
High 7.8
af_unix: Don't leave consecutive consumed OOB skbs.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket impor…
-
High 7.8
eventpoll: don't decrement ep refcount while still holding the ep mutex
In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. Th…
-
High 7.8
xfrm: interface: fix use-after-free after changing collect_md xfrm interface
In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail whe…
-
High 7.8
Integer Overflow or Wraparound in Audio
Memory corruption while routing GPR packets between user and root when handling large data packet.
-
High 7.8
Integer Overflow or Wraparound in DSP Service
Memory corruption while processing user buffers.
-
High 7.8
Use After Free in DSP Service
Memory corruption while allocating buffers in DSP service.
-
High 7.8
Incorrect Authorization in Boot
Memory corruption while loading an invalid firmware in boot loader.
-
High 7.8
In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications w…
-
High 7.8
In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to m…
-
High 7.8
In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a co…
-
High 7.8
In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the co…
-
High 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 7.8
In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in…
-
High 7.8
In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypas…
-
High 7.8
In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in …
-
High 7.8CVE-2025-48583 Public exploit
In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the…
-
High 7.8
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to…
-
High 7.8
In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. Thi…
-
High 7.8
In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due …
-
High 7.8
In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges …
-
High 7.8
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to l…
-
High 7.8
In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay …
-
High 7.8
In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due t…
-
High 7.8
In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's defa…
-
High 7.8
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaus…
-
High 7.8CVE-2025-48617 Public exploit
In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass.…
-
High 7.8
In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application'…
-
High 7.8
In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could l…
-
High 7.8
In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation. This …
-
High 7.8
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the…
-
High 7.8
In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused de…
-
High 7.8
In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech rec…
-
High 7.8
In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the us…
-
High 7.8
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could …
-
High 7.8
In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In ims service, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escala…
-
High 7.5
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalatio…
-
High 7.5
In dpc modem, there is a possible system crash due to null pointer dereference. This could lead to remote denial of ser…
-
High 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
High 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote escalation of pr…
-
High 7.5
GPU DDK - Multiple calls into PhysmemGEMPrimeExport can inherit write access permission for an existing read-only dma_buf import PMR
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. This is caused by improper handling of the memory protections for the buffer resource.
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.5
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of ser…
-
High 7.3
In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This…
-
High 7.3
In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjackin…
-
High 7.0
In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escal…
-
Medium 6.7CVE-2025-20730 Public exploit
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local es…
-
Medium 6.7
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input vali…
-
Medium 6.7
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions …
-
Medium 6.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere in HLOS
Information disclosure while exposing internal TA-to-TA communication APIs to HLOS
-
Medium 6.6
In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deput…
-
Medium 6.6
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due t…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE h…
-
Medium 6.5
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 6.5
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.5
Reachable Assertion in BT Controller
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.
-
Medium 6.5
In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could …
-
Medium 6.5
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaust…
-
Medium 6.3
af_unix: Clear stale u->oob_skb.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Clear stale u->oob_skb. syzkaller started to report deadlock of unix_gc_lock after commit 4090fa373f0e ("af_unix: Replace garbage collection algorithm."), but it just uncovers the bu…
-
Medium 5.5
GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misused
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger NULL pointer dereference kernel exceptions.
-
Medium 5.5
In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permane…
-
Medium 5.5
In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel lim…
-
Medium 5.5
In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergenc…
-
Medium 5.5
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This …
-
Medium 5.5
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This c…
-
Medium 5.5
In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lea…
-
Medium 5.5
In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion.…
-
Medium 5.5
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This …
-
Medium 5.5
In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. Th…
-
Medium 5.5
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error i…
-
Medium 5.5
In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lea…
-
Medium 5.3
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 5.3
In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of s…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Medium 5.1
GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAF
Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
-
Medium 5.1
Mali GPU Kernel Driver allows improper GPU memory processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This i…
-
Medium 4.9
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, i…
-
Medium 4.3
In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due…
-
Medium 4.0CVE-2025-8045 Public exploit
Mali GPU Kernel Driver allows improper GPU processing operations
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU processing operations to gain access to already freed memory.This issue af…
Revision history
-
#5
Referenz(en) aufgenommen: EUVD-2025-210214
-
#4
Referenz(en) aufgenommen: EUVD-2025-204028, EUVD-2025-204025, EUVD-2025-204024
-
#3
Neue Updates von LENOVO aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2025-201734, EUVD-2025-201735, EUVD-2025-201736, EUVD-2025-201737, EUVD-2025-201738, EUVD-2025-201740, EUVD-2025-201741, EUVD-2025-201742, EUVD-2025-201743, EUVD-2025-201744, EUVD-2025-201745, EUVD-2025-201746, EUVD-2025-201748, EUVD-2025-201747, EUVD-2025-201750, EUVD-2025-201751, EUVD-2025-201752, EUVD-2025-201753, EUVD-2025-201754, EUVD-2025-201755, EUVD-2025-201756, EUVD-2025-201757, EUVD-2025-201758, EUVD-2025-201759, EUVD-2025-201760, EUVD-2025-201761, EUVD-2025-201762, EUVD-2025-201763, EUVD-2025-201764, EUVD-2025-201765, EUVD-2025-201766, EUVD-2025-201767, EUVD-2025-201768, EUVD-2025-201770, EUVD-2025-201772, EUVD-2025-201773, EUVD-2025-201774, EUVD-2025-201775, EUVD-2025-201769, EUVD-2025-201771, EUVD-2025-201776, EUVD-2025-201777, EUVD-2025-201778, EUVD-2025-201779, EUVD-2025-201780, EUVD-2025-201781, EUVD-2025-201782, EUVD-2025-201788, EUVD-2025-201783, EUVD-2025-201785, EUVD-2025-201787, EUVD-2025-201739, EUVD-2025-201749, EUVD-2025-201784
-
#1
Initiale Fassung
References
-
Sicherheitsbulletin für Android – Dezember 2025 vom 2025-12-01
https://source.android.com/docs/security/bulletin/2025-12-01
-
Lenovo Security Advisory LEN-207909 vom 2025-12-10
https://support.lenovo.com/us/en/product_security/LEN-207909