| CVE-2026-0116 |
In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check
|
9.8
Critical
|
Mar 10, 2026 |
| CVE-2026-0114 |
In Modem, there is a possible out of bounds write due to an incorrect bounds check
|
9.8
Critical
|
Mar 10, 2026 |
| CVE-2026-0113 |
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check
|
9.8
Critical
|
Mar 10, 2026 |
| CVE-2026-0111 |
In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check
|
9.8
Critical
|
Mar 10, 2026 |
| CVE-2026-0110 |
In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption
|
9.8
Critical
|
Mar 10, 2026 |
| CVE-2025-48611 |
In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check
|
10.0
Critical
|
Mar 10, 2026 |
| CVE-2026-0006 |
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow
|
9.8
Critical
|
Mar 2, 2026 |
| CVE-2025-48645 |
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation
|
9.8
Critical
|
Mar 2, 2026 |
| CVE-2025-48609 |
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony,…
|
9.1
Critical
|
Mar 2, 2026 |
| CVE-2026-0106 |
In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check
|
9.3
Critical
|
Feb 5, 2026 |
| CVE-2025-36937 |
In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect…
|
9.8
Critical
|
Dec 11, 2025 |
| CVE-2025-36904 |
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384
|
9.8
Critical
|
Sep 4, 2025 |
| CVE-2025-36897 |
In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check
|
9.8
Critical
|
Sep 4, 2025 |
| CVE-2025-36896 |
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106
|
9.8
Critical
|
Sep 4, 2025 |
| CVE-2025-36890 |
Elevation of Privilege
|
9.8
Critical
|
Sep 4, 2025 |
| CVE-2025-26416 |
In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow
|
9.8
Critical
|
Sep 2, 2025 |
| CVE-2025-22435 |
In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion
|
9.8
Critical
|
Sep 2, 2025 |
| CVE-2025-22429 |
In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code
|
9.8
Critical
|
Sep 2, 2025 |
| CVE-2025-22408 |
In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free
|
9.8
Critical
|
Aug 26, 2025 |
| CVE-2025-22403 |
In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use…
|
9.8
Critical
|
Aug 26, 2025 |
| CVE-2025-0075 |
In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use…
|
9.8
Critical
|
Aug 26, 2025 |
| CVE-2025-0074 |
In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after…
|
9.8
Critical
|
Aug 26, 2025 |
| CVE-2024-49747 |
In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the…
|
9.8
Critical
|
Jan 21, 2025 |
| CVE-2024-49748 |
In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer…
|
9.8
Critical
|
Jan 21, 2025 |
| CVE-2017-13322 |
In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services…
|
10.0
Critical
|
Jan 17, 2025 |