Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android Pixel ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen und vertrauliche Informationen offenzulegen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 41
-
High 8.8
In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code exec…
-
High 8.8
In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code executi…
-
High 8.8
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code executi…
-
High 8.8
In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bo…
-
High 8.8
In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a miss…
-
High 8.8
In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer over…
-
High 8.8
In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remot…
-
High 8.8
In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead …
-
High 8.8
In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This co…
-
High 8.8
In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due …
-
High 8.8
In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This cou…
-
High 8.8
In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to…
-
High 8.8
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code executi…
-
High 7.8
In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due …
-
High 7.8
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code executio…
-
High 7.8
In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use aft…
-
High 7.8
In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This cou…
-
High 7.8
In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This…
-
High 7.8
In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow…
-
High 7.8
In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand…
-
High 7.8
In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could…
-
High 7.5
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
High 7.5
In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This co…
-
High 7.5
In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This…
-
High 7.3
In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to loc…
-
High 7.0
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to lo…
-
Medium 6.5
In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memor…
-
Medium 6.5
In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. …
-
Medium 6.5
Integer Underflow (Wrap or Wraparound) in WLAN Host
Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.
-
Medium 5.5
Buffer Over-read in WLAN Host Communication
Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
-
Medium 5.3
In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to…
-
Medium 5.3
In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to re…
-
Medium 4.3
In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead…
-
Medium 4.3
In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote informa…
-
Medium 4.3
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to…
-
Medium 4.3
In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remot…
-
Medium 4.3
In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote …
-
Medium 4.0
In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic err…
-
Medium 4.0
In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This coul…
-
Medium 4.0
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local informatio…
-
Medium 4.0
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to …
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-52730
-
#1
Initiale Fassung
References
-
Pixel Update Bulletin – Juni 2026 vom 2026-06-16
https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01