85 results · Clear filters · Feed
-
Critical 9.8
In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to rem…
-
Critical 9.8
In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote c…
-
Critical 9.8
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code …
-
Critical 9.8CVE-2026-58868 Public exploit
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This co…
-
Critical 9.8
In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the …
-
Critical 9.8
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote e…
-
Critical 9.8
In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead…
-
Critical 9.8
In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead t…
-
Critical 9.8
In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote…
-
Critical 9.8
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the c…
-
Critical 9.8CVE-2026-0163 Public exploit
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to re…
-
Critical 10.0
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could …
-
Critical 10.0
In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a l…
-
Critical 10.0
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing pe…
-
Critical 10.0
In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lea…
-
Critical 10.0
In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local …
-
Critical 10.0
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due t…
-
Critical 10.0
In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escal…
-
Critical 10.0
In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local…
-
Critical 10.0
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSessio…
-
Critical 10.0
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loc…
-
Critical 10.0CVE-2026-0092 Public exploit
In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lea…
-
Critical 10.0
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed…
-
Critical 10.0
There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege…
-
Critical 9.8
In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code exec…
-
Critical 9.8
In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. …
-
Critical 9.8
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code exec…
-
Critical 9.8
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. Thi…
-
Critical 9.8
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. Thi…
-
Critical 9.8
In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote…
-
Critical 10.0
In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead …
-
Critical 9.8CVE-2026-0006 Public exploit
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead …
-
Critical 9.8
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. Th…
-
Critical 9.1
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, …
-
Critical 9.3
In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to …
-
Critical 9.8
In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect …
-
Critical 9.8
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384.
-
Critical 9.8
In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Critical 9.8
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106.
-
Critical 9.8