Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android Pixel ausnutzen, um Code auszuführen, höhere Berechtigungen zu erlangen, Informationen offenzulegen oder die Verfügbarkeit von Gerätefunktionen zu beeinträchtigen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 158
-
Critical 9.8
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote c…
-
Critical 9.8
In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote cod…
-
Critical 9.8
In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the cod…
-
Critical 9.8
In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the …
-
Critical 9.8
In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a miss…
-
Critical 9.8
In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote co…
-
Critical 9.8
In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bou…
-
Critical 9.8
In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due…
-
Critical 9.8
In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in t…
-
Critical 9.8
In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to rem…
-
Critical 9.8
In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bou…
-
Critical 9.8
In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption.…
-
Critical 9.8
In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a possible way to trigger an out of bounds write due to a log…
-
Critical 9.8
In SendInfo of UssiController.cpp, there is a possible way to corrupt memory via a dangling connection listener pointer…
-
High 8.8
In PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity launch due to a confus…
-
High 8.8
In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This …
-
High 8.8
In chppWifiRangingEventNotification of clients/wifi.c, there is a possible Heap Buffer Overflow due to a logic error in…
-
High 8.8
In multiple functions of cn_Tai.cpp, there is a possible way to trigger an out of bounds write due to memory corruption…
-
High 8.4
In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test …
-
High 8.4
In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a …
-
High 8.4
In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault in…
-
High 8.4
In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead t…
-
High 8.4
In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to m…
-
High 8.4
In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel…
-
High 8.4
In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages du…
-
High 8.4
In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an in…
-
High 8.4
In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and …
-
High 8.4
In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream …
-
High 8.4
In on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a possible way to leak hos…
-
High 8.4
In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappi…
-
High 8.4
In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared mem…
-
High 8.4
In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a mi…
-
High 8.4
In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to loc…
-
High 8.4
In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the …
-
High 8.4
In getChppAppState of chpp_init.cc, there is a possible way to trigger an out of bounds read and corrupt task control s…
-
High 8.4
In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead …
-
High 8.4
In stpropnci_process_std of stpropnci_std.cc, there is a possible way to trigger an out of bounds write into global sta…
-
High 8.4
In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via expo…
-
High 8.4
In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized sc…
-
High 8.4
In stpropnci_prop_st_build_set_custom_polling_cmd of stpropnci_prop_st.cc, there is a possible way to trigger an out of…
-
High 8.4
In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coproces…
-
High 8.4
In bindDataService of DataServiceManager.java, there is a possible way to retain privileged tunnel management permissio…
-
High 8.4
In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier …
-
High 8.4
In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass ro…
-
High 8.4
In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due …
-
High 8.4
In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap d…
-
High 8.4
In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size unde…
-
High 7.8
In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead…
-
High 7.8
In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due…
-
High 7.8
In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This …
-
High 7.8
In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This …
-
High 7.8
In ac_remove_smmu_prot_internal of acfw_smmu.c, there is a possible Logic error due to a logic error in the code. This …
-
High 7.8
In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a…
-
High 7.8
In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a log…
-
High 7.8
In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could …
-
High 7.8
In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic er…
-
High 7.8
In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there …
-
High 7.8
In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the cod…
-
High 7.8
In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the truste…
-
High 7.8
In codec3p_secure of codec3p_secure, there is a possible Heap Buffer Overflow due to a missing bounds check. This could…
-
High 7.8
In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This…
-
High 7.8
In mfc_alloc_enc_roi_buffer of mfc_buf.c, there is a possible out-of-bounds write due to a heap buffer overflow. This c…
-
High 7.8
In cnm_memset of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead t…
-
High 7.8
In CMD_ENC_SET_PARAM of encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead…
-
High 7.8
In pic_timing of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead t…
-
High 7.8
In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could…
-
High 7.8
In s_check_valid_tile_param_custom_tile of av1_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer ov…
-
High 7.8
In s_av1_dec_metadata_scalability of av1_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow…
-
High 7.8
In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to…
-
High 7.8
In spm_alloc of encoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to loc…
-
High 7.8
In platform_rio_ncp_wdt_handler of edgetpu_rio.c, there is a possible Use After Free due to a use after free. This coul…
-
High 7.8
In TzPipelineInputExtractor of TzPipelineInputExtractor.cpp, there is a possible Logic check bypass due to a logic erro…
-
High 7.8
In tone_mapping_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could…
-
High 7.8
In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could l…
-
High 7.8
In prev_run_vcore of hwcodec_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This coul…
-
High 7.8
In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could …
-
High 7.8
In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to lo…
-
High 7.8
In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. Thi…
-
High 7.8
In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This coul…
-
High 7.8
In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead…
-
High 7.5
In s_gen_tile_param of multiple files, there is a possible way to trigger an out of bounds write in tile parameter arra…
-
High 7.5
In Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leak…
-
High 7.5
In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due…
-
High 7.5
In SetDisplayName of RegInfoContact.cpp, there is a possible denial of service due to a missing null check. This could …
-
High 7.5
In DecodeHeaderComponent of SipStack.cpp, there is a possible way to trigger stack exhaustion via unbounded mutual recu…
-
High 7.5
In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abo…
-
High 7.5
In multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap du…
-
High 7.5
In multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to …
-
High 7.5
In CompareTelUris of SipAddress.cpp, there is a possible way to trigger an unhandled out of range exception and process…
-
High 7.5
In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undr…
-
High 7.0
In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalat…
-
Medium 6.8
In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the code. This could lead to …
-
Medium 6.8
In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection d…
-
Medium 6.7
In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stre…
-
Medium 6.7
In km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a…
-
Medium 6.7
In ac_set_ns_ipa_tbl of plat_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalid…
-
Medium 6.7
In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure so…
-
Medium 6.7
In handle_fips_hmac_req of hwcrypto_proxy.c, there is a possible heap buffer overflow due to missing bounds check. This…
-
Medium 6.7
In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page referenc…
-
Medium 6.7
In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corrup…
-
Medium 6.7
In access_control_enable of multiple files, there is a possible way to release secure coprocessors from reset via uncla…
-
Medium 6.7
In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on pro…
-
Medium 6.7
In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the co…
-
Medium 6.7
In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. …
-
Medium 6.7
In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local …
-
Medium 6.7
In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local esca…
-
Medium 6.7
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local…
-
Medium 6.7
In HostLinkBase::chreIpiHandler of host_link.cc, there is a possible out-of-bounds write due to a missing bounds check.…
-
Medium 6.7
In update_user_consent of main.rs, there is a possible elevation of privilege due to uninitialized data. This could lea…
-
Medium 6.7
In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due…
-
Medium 6.7
In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead…
-
Medium 6.7
In mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping size truncation due t…
-
Medium 6.7
In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure softw…
-
Medium 6.7
In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure softwa…
-
Medium 6.4
In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent sh…
-
Medium 6.4
In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loa…
-
Medium 6.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation …
-
Medium 6.4
In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared …
-
Medium 6.2
In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This…
-
Medium 6.2
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local…
-
Medium 6.2
In stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc, there is a possible way to trigger an out of bounds …
-
Medium 6.2
In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic er…
-
Medium 6.2
In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of servic…
-
Medium 5.3
In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the co…
-
Medium 5.3
In CalculateSampleRate of cldma_alcedo.cc, there is a possible Heap Buffer Overflow due to a logic error in the code. T…
-
Medium 4.4
In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local…
-
Medium 4.0
In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due…
-
Medium 4.0
In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack m…
-
Medium 4.0
In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to …
-
Medium 4.0
In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead…
-
Medium 4.0
In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused d…
-
Medium 4.0
In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to …
-
Medium 4.0
In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access ma…
-
Medium 4.0
In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could …
-
Medium 4.0
In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to impro…
-
Medium 4.0
In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent …
-
Medium 4.0
In multiple locations, there is a possible way to trigger an out of bounds read via direct memory access in video decod…
-
Medium 4.0
In s_copy_host_apb_param of multiple files, there is a possible way to trigger an out of bounds read in the video decod…
-
Low 3.3
In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to lo…
-
Low 3.3
In register_dump_dpa of sswrp_pcie.c, there is a possible Logic error due to a logic error in the code. This could lead…
-
Low 3.3
In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could…
-
Low 3.3
In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to loc…
-
Low 3.3
In trusty_context_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a…
-
Low 3.3
In userdata_report of hwcodec_firmware, there is a possible Logic error due to a logic error in the code. This could le…
-
Low 2.9
In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information di…
-
Low 2.7
In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via …
-
Low 2.4
In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when for…
-
Low 2.3
In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-…
-
Low 2.3
In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sig…
-
Low 2.3
In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle du…
-
Low 2.3
In ac_get_prot_config of plat_trusty.c, there is a possible memory corruption due to improper input validation. This co…
-
Low 2.3
In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local i…
-
Low 2.3
In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassign…
-
Low 2.3
In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a…
-
Low 2.3
In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to…
-
Low 2.3
In getCodecQp of GC2AV1Enc.cpp, there is a possible way to trigger an out of bounds read during quantization table look…
-
Unscored —CVE-2026-59599 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
In multiple functions of oem_svc_setup.c, there is a possible way to dump secure cache lines into non-secure memory on …
Revision history
-
#1
Initiale Fassung
References
-
Google Android Pixel Bulletin November 2026 vom 2026-11-10
https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01