Android
Monthly
Android versions up to 13.0 contains a vulnerability that allows attackers to bypass Carrier Relock (CVSS 4.6).
libimagecodec.quram.so in Android devices prior to the January 2026 Security Maintenance Release 1 contains an out-of-bounds read vulnerability that allows remote attackers to access sensitive memory without authentication. The vulnerability has a network attack vector with low complexity, enabling potential information disclosure through specially crafted input. No patch is currently available.
Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. [CVSS 3.3 LOW]
Android versions up to 13.0 contains a vulnerability that allows attackers to access file with system privilege (CVSS 5.5).
Arbitrary code execution in Android's DualDAR component prior to the January 2026 security patch stems from a use-after-free memory vulnerability that can be exploited by local attackers with elevated privileges. An attacker with high-level device access could leverage this flaw to execute arbitrary code with system-level permissions. No patch is currently available, leaving affected devices vulnerable until the SMR January 2026 Release 1 update is deployed.
UI spoofing in the Chromium-based Microsoft Edge browser on Android lets a remote, unauthenticated attacker misrepresent browser interface elements so that victims believe they are viewing trusted content, which can be leveraged for phishing or social engineering. Exploitation requires the user to open attacker-controlled web content and interact with it (UI:R), and the attacker must satisfy specific rendering and timing conditions (AC:H); there is no data disclosure, no code execution, and no availability impact (C:N/I:L/A:N, CVSS 3.1). EPSS is 0.28% (18th percentile) and no public exploit code has been identified at time of analysis - this is a low-priority issue confined to the Android build listed in the CPE, not the desktop release.
Any third-party app already installed on a Transsion HiOS 14.0.0 handset can silently activate ADB debugging by sending an explicit Android intent to the exported, unprotected activity com.transsion.tranfacmode.entrance.main.MainActivity, with no user interaction and no prompt. Exploitation is local rather than remote - the attacker must first get a malicious or compromised application onto the device and running as an installed app, which is why our assessment rates the vector AV:L/AC:L/PR:N/UI:N and scores it 6.5 with limited confidentiality and integrity impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the underlying defect is missing authorization (CWE-862) on a system component that should never have been reachable from unprivileged third-party code.
UI spoofing in LINE for Android versions prior to 14.20 enables unauthenticated remote attackers to impersonate legitimate interfaces within the in-app browser, potentially leading to credential phishing. The vulnerability occurs because the full-screen security Toast notification, which normally displays the true origin of a web page, is not re-displayed when a user switches to another app and then returns to LINE, creating a window where a spoofed page can be presented. Exploitation requires user interaction (opening a malicious link and performing the app-switch sequence), and while no public exploit or active exploitation has been identified, the EPSS score is 0.18% (7th percentile).
UI spoofing in the LINE client for Android versions 13.8 through 15.5 allows a malicious page loaded in LINE's in-app browser to obscure the full-screen warning prompt using a crafted layout, enabling phishing-style deception of the user. The flaw is network-delivered and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) but requires the victim to open an attacker-supplied link and then trust and interact with the spoofed interface, so real-world exploitation depends entirely on successful social engineering. Impact is limited to integrity of the user's perception of a security warning (CWE-451); there is no code execution, data read, or denial of service, and no public exploit code or confirmed active exploitation was identified at time of analysis, with EPSS at 0.18% (7th percentile) indicating a low predicted likelihood of exploitation.
Domain spoofing in the toolbar of Google Chrome for Android before 143.0.7499.110 lets a remote, unauthenticated attacker deceive users about the true origin of a page by having them open a crafted HTML page. Exploitation requires the victim to actively navigate to the attacker's page (UI:R) and depends entirely on the user believing the spoofed address bar, so impact is limited to phishing facilitation rather than code execution, data theft, or session compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.27% (18th percentile); per Google's own rating this is a Medium-severity Chromium issue, and the vendor fix is available in version 143.0.7499.110.
Information disclosure in Brother iPrint&Scan for Android versions 6.13.7 and earlier occurs because the app stores application-specific files in an external cache directory that other apps on the same device can read. A malicious Android app already installed on the victim’s device could access those cached files, but exploitation is local, requires the victim to have installed the attacker’s app, and is limited to low confidentiality impact with no integrity, availability, or code-execution impact. No public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile), and this is a low-to-moderate priority information-disclosure issue rather than an urgent remote compromise.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcd_handle_mcq_cq_events() and also in ufs_mtk_mcq_intr(). The following warning message will be generated when &hwq->cq_lock is used in IRQ context with IRQ enabled. Use ufshcd_mcq_poll_cqe_lock() with spin_lock_irqsave instead of spin_lock to resolve the deadlock issue. [name:lockdep&]WARNING: inconsistent lock state [name:lockdep&]-------------------------------- [name:lockdep&]inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [name:lockdep&]kworker/u16:4/260 [HC0[0]:SC0[0]:HE1:SE1] takes: ffffff8028444600 (&hwq->cq_lock){?.-.}-{2:2}, at: ufshcd_mcq_poll_cqe_lock+0x30/0xe0 [name:lockdep&]{IN-HARDIRQ-W} state was registered at: lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufs_mtk_mcq_intr+0x60/0x1bc [ufs_mediatek_mod] __handle_irq_event_percpu+0x140/0x3ec handle_irq_event+0x50/0xd8 handle_fasteoi_irq+0x148/0x2b0 generic_handle_domain_irq+0x4c/0x6c gic_handle_irq+0x58/0x134 call_on_irq_stack+0x40/0x74 do_interrupt_handler+0x84/0xe4 el1_interrupt+0x3c/0x78 <snip> Possible unsafe locking scenario: CPU0 ---- lock(&hwq->cq_lock); <Interrupt> lock(&hwq->cq_lock); *** DEADLOCK *** 2 locks held by kworker/u16:4/260: [name:lockdep&] stack backtrace: CPU: 7 PID: 260 Comm: kworker/u16:4 Tainted: G S W OE 6.1.17-mainline-android14-2-g277223301adb #1 Workqueue: ufs_eh_wq_0 ufshcd_err_handler Call trace: dump_backtrace+0x10c/0x160 show_stack+0x20/0x30 dump_stack_lvl+0x98/0xd8 dump_stack+0x20/0x60 print_usage_bug+0x584/0x76c mark_lock_irq+0x488/0x510 mark_lock+0x1ec/0x25c __lock_acquire+0x4d8/0xffc lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufshcd_poll+0x68/0x1b0 ufshcd_transfer_req_compl+0x9c/0xc8 ufshcd_err_handler+0x3bc/0xea0 process_one_work+0x2f4/0x7e8 worker_thread+0x234/0x450 kthread+0x110/0x134 ret_from_fork+0x10/0x20
In the Linux kernel, the following vulnerability has been resolved: kcsan: Avoid READ_ONCE() in read_instrumented_memory() Haibo Li reported: | Unable to handle kernel paging request at virtual address | ffffff802a0d8d7171 | Mem abort info:o: | ESR = 0x9600002121 | EC = 0x25: DABT (current EL), IL = 32 bitsts | SET = 0, FnV = 0 0 | EA = 0, S1PTW = 0 0 | FSC = 0x21: alignment fault | Data abort info:o: | ISV = 0, ISS = 0x0000002121 | CM = 0, WnR = 0 0 | swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000002835200000 | [ffffff802a0d8d71] pgd=180000005fbf9003, p4d=180000005fbf9003, | pud=180000005fbf9003, pmd=180000005fbe8003, pte=006800002a0d8707 | Internal error: Oops: 96000021 [#1] PREEMPT SMP | Modules linked in: | CPU: 2 PID: 45 Comm: kworker/u8:2 Not tainted | 5.15.78-android13-8-g63561175bbda-dirty #1 | ... | pc : kcsan_setup_watchpoint+0x26c/0x6bc | lr : kcsan_setup_watchpoint+0x88/0x6bc | sp : ffffffc00ab4b7f0 | x29: ffffffc00ab4b800 x28: ffffff80294fe588 x27: 0000000000000001 | x26: 0000000000000019 x25: 0000000000000001 x24: ffffff80294fdb80 | x23: 0000000000000000 x22: ffffffc00a70fb68 x21: ffffff802a0d8d71 | x20: 0000000000000002 x19: 0000000000000000 x18: ffffffc00a9bd060 | x17: 0000000000000001 x16: 0000000000000000 x15: ffffffc00a59f000 | x14: 0000000000000001 x13: 0000000000000000 x12: ffffffc00a70faa0 | x11: 00000000aaaaaaab x10: 0000000000000054 x9 : ffffffc00839adf8 | x8 : ffffffc009b4cf00 x7 : 0000000000000000 x6 : 0000000000000007 | x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffffffc00a70fb70 | x2 : 0005ff802a0d8d71 x1 : 0000000000000000 x0 : 0000000000000000 | Call trace: | kcsan_setup_watchpoint+0x26c/0x6bc | __tsan_read2+0x1f0/0x234 | inflate_fast+0x498/0x750 | zlib_inflate+0x1304/0x2384 | __gunzip+0x3a0/0x45c | gunzip+0x20/0x30 | unpack_to_rootfs+0x2a8/0x3fc | do_populate_rootfs+0xe8/0x11c | async_run_entry_fn+0x58/0x1bc | process_one_work+0x3ec/0x738 | worker_thread+0x4c4/0x838 | kthread+0x20c/0x258 | ret_from_fork+0x10/0x20 | Code: b8bfc2a8 2a0803f7 14000007 d503249f (78bfc2a8) ) | ---[ end trace 613a943cb0a572b6 ]----- The reason for this is that on certain arm64 configuration since e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y"), READ_ONCE() may be promoted to a full atomic acquire instruction which cannot be used on unaligned addresses. Fix it by avoiding READ_ONCE() in read_instrumented_memory(), and simply forcing the compiler to do the required access by casting to the appropriate volatile type. In terms of generated code this currently only affects architectures that do not use the default READ_ONCE() implementation. The only downside is that we are not guaranteed atomicity of the access itself, although on most architectures a plain load up to machine word size should still be atomic (a fact the default READ_ONCE() still relies on itself).
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
A security vulnerability in the KDE Connect information-exchange protocol (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
A security vulnerability in KDE Connect (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v2.2.5.
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.
In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117735; Issue ID: MSV-4539.
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4752.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184297; Issue ID: MSV-4759.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4796.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4797.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
CVE-2025-20771 is a security vulnerability (CVSS 6.7). Remediation should follow standard vulnerability management procedures.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4803.
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4804.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.
In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4807.
CVE-2025-20766 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation.
In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.
In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10259774; Issue ID: MSV-5029.
In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267218; Issue ID: MSV-5032.
Improper verification of the source of a communication channel in Samsung SmartTouchCall prior to version 1.0.1.1 lets a remote, unauthenticated attacker spoof a trusted communication origin and read sensitive information, but the victim must actively interact with the crafted communication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 6.5). Exploitation is constrained by the mandatory user-interaction step and the app-specific attack surface, and no public exploit has been identified at time of analysis; EPSS is 0.05% (17th percentile) and the issue is not in CISA KEV, marking it as moderate rather than urgent. Impact is limited to confidentiality - there is no integrity or availability effect.
Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
Information disclosure in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated remote attackers to read memory outside the bounds of the parsing buffer when a crafted malformed image is decoded, affecting Android 13, 14, 15 and 16 firmware prior to SMR Dec-2025 Release 1. Samsung and NVD rate the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while our assessment treats it as requiring user interaction (UI:R) with low confidentiality impact (C:L), since the leak is bounded to memory adjacent to the parsing buffer and is most useful as a primitive chained with another bug. No public exploit code has been identified at time of analysis and EPSS is low (0.06%, 17th percentile), so broad exploitation is unlikely without a companion memory-corruption flaw.
Samsung Android 13, 14, 15, and 16 devices running firmware prior to SMR Dec-2025 Release 1 contain an out-of-bounds memory access flaw in the Quram-supplied image decoder libimagecodec.quram.so, reachable by remote unauthenticated attackers who supply a crafted image for parsing. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), the confirmed impact is high confidentiality loss only, consistent with out-of-bounds read/disclosure rather than confirmed code execution, and no single-click user interaction is strictly required for the vulnerable decode path. Exploitation is currently limited by the low EPSS score (0.07%, 22nd percentile), no public exploit code and no confirmed active exploitation (not in CISA KEV), and the practical need to route a malicious image into the specific vulnerable codec, for example via message attachment or thumbnail auto-decoding.
Opening or previewing a maliciously crafted image on an unpatched Samsung Android device can force the Quram image codec (libimagecodec.quram.so) to read out-of-bounds memory while parsing an IFD (EXIF/TIFF) tag, disclosing memory contents to a remote attacker. The flaw affects Samsung Android 13, 14, 15, and 16 builds below patch level SMR Dec-2025 Release 1, is reachable without authentication (PR:N) but is gated by mandatory user interaction (UI:R) since the victim must receive and render the image, and its assessed impact is confidentiality-only (C:H/I:N/A:N, CVSS 6.5 Medium). EPSS is low at 0.07% (22nd percentile) and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Samsung Android bootloader allows an attacker with physical possession of and hands-on access to an affected device to read out-of-bounds memory from the bootloader stage. Only devices running firmware builds below the SMR Dec-2025 Release 1 patch level (spanning Android 13, 14, 15 and 16 per the vendor advisory) are affected, and the physical-access prerequisite (CVSS AV:P, unauthenticated per PR:N, no user interaction per UI:N) is the decisive limiter - there is no remote or network exploitation path. Impact is confidentiality-only (C:H with I:N/A:N) with no described code-execution primitive, no public exploit code and no confirmed active exploitation (CISA KEV not listed); EPSS is 0.02% (6th percentile), consistent with a low real-world priority issue.
Improper export of the Dynamic Lockscreen component on Samsung Android devices allows an app already installed and running on the phone to access files with Dynamic Lockscreen's privileges, producing high confidentiality and integrity impact on the data it exposes. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1): the attacker must be able to install and run a low-privilege malicious app, after which no further user interaction is required, and there is no remote or network exploitation path. No public exploit code has been identified at time of analysis and EPSS is negligible (0.02%, 4th percentile), but the flaw is remediated only by Samsung's SMR Dec-2025 Release 1 update, so devices still on patch levels up to SMR Nov-2025 R1 remain vulnerable.
An out-of-bounds write in the fingerprint trustlet's metadata-decoding routine affects Samsung Android devices running Android 13 through 16 that have not yet received the SMR Dec-2025 Release 1 maintenance patch. Exploitation requires an attacker to already hold a privileged local foothold on the device (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - there is no remote path and no unprivileged-app path - and the assessed impact is integrity-only within the trustlet's security scope, with no confidentiality or availability effect. Severity is low: EPSS is 0.02% (4th percentile), no public exploit code and no confirmed active exploitation were identified at time of analysis, making the pre-existing privileged local access the dominant limiting factor rather than the memory-corruption class itself.
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Inefficient regular expression complexity (ReDoS) in Zoom Workplace Client and Zoom Meeting SDK builds for Android and iOS earlier than 6.5.10 allows a remote, unauthenticated attacker to force the client to process crafted input through a vulnerable regular-expression code path, causing excessive CPU consumption and potential client unavailability; no user interaction is required per the CVSS vector (AV:N/PR:N/UI:N). The NVD score of 9.8 (C:H/I:H/A:H) overstates impact relative to the underlying CWE-1333 weakness - our independent assessment re-scores this as availability-only (C:N/I:N/A:H) - and the public description's claim of 'escalation of privilege' is not supported by the ReDoS root cause; treat the privilege-escalation framing with caution. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.12% (31st percentile), indicating limited near-term exploitation likelihood despite the high headline score.
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.
Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. Rated medium severity (CVSS 5.7). No vendor patch available.
In charger, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In apusys, there is a possible memory corruption due to use after free. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In pda, there is a possible escalation of privilege due to use after free. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In clkdbg, there is a possible escalation of privilege due to use after free. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In preloader, there is a possible escalation of privilege due to an insecure default value. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Google Messages running as the default SMS/MMS/RCS application on Wear OS smartwatches can be induced to silently send text or multimedia messages to arbitrary recipients on the user's behalf, without SMS permissions and, per the vendor description, without further user interaction. Exploitation is not remote in practice: it requires a Wear OS device configured with Google Messages as the default messaging app plus an already-present malicious or compromised app capable of firing Android intents, a local foothold rather than a network-reachable entry point, and the vendor vector's UI:P (passive interaction) marking further limits how fully silent the attack can be. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; EPSS is negligible at 0.14% (3rd percentile), and the overall picture is a medium-severity, low-urgency issue confined to the Wear OS platform.
Out-of-bounds write in Samsung Notes' SPI decoder affects versions prior to 4.4.30.63 and allows a local low-privileged attacker, typically a separate malicious or compromised app, to corrupt memory by supplying a crafted SPI-format file. The CVSS vector requires local access and low privileges (AV:L/PR:L) with no user interaction (UI:N), and impact is limited to integrity (I:H) with no confidentiality or availability effect. There is no KEV listing and no public exploit identified at time of analysis; EPSS is 0.12% (2nd percentile), making this a moderate, low-priority issue rather than an urgent one.
Out-of-bounds memory disclosure in Samsung Notes prior to 4.4.30.63 allows local attackers with low privileges to read beyond allocated buffers when parsing crafted images, potentially leaking sensitive data. The attack requires user interaction to open the malicious image, and while it has high confidentiality impact, availability impact is low. This vendor-reported issue (mobile.security@samsung.com) has no public exploit code or active exploitation identified at time of analysis.
An out-of-bounds read (CWE-125) in how Samsung Notes parses image data allows a locally positioned attacker to read past the end of an allocated buffer and expose out-of-bounds memory contents; versions prior to 4.4.30.63 are affected. Exploitation requires a pre-existing low-privilege foothold on the device - a malicious installed app or the ability to get a crafted image opened in Notes - with no network attack path and no user interaction required once that foothold exists (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). The impact is confidentiality-focused memory disclosure rather than code execution or a write primitive; there is no public exploit identified at time of analysis, CISA KEV does not list it, and EPSS is only 0.12% (2nd percentile), so this is a genuine but comparatively low-urgency issue that is fully resolved by updating to 4.4.30.63 or later.
Out-of-bounds read in Samsung Notes' image-buffer allocation path lets a locally installed, low-privileged app read adjacent process memory on all builds prior to 4.4.30.63. Exploitation requires local code execution with low privileges (PR:L per the assessed CVSS vector) and no user interaction, and the outcome is bounded to information disclosure of out-of-bounds memory rather than code execution, with at most a Low availability impact from a possible app crash. Our assessment rates this as a genuinely mid-tier issue: the strictly local attack surface heavily constrains real-world risk compared with the vendor's 7.1 score, EPSS is only 0.12% (2nd percentile), and no public exploit identified at time of analysis; confirmed actively exploited status has not been established (no CISA KEV listing).
Out-of-bounds read in the SPI decoder of Samsung Notes prior to version 4.4.30.63 allows local attackers with low-level privileges to access out-of-bounds memory, potentially causing information disclosure and availability impact. This moderate-severity, low-urgency vulnerability requires local access (no remote vector) and no user interaction, and is limited to devices with the vulnerable app. No public exploit code exists, and the EPSS score is very low (0.12%, 2nd percentile), indicating minimal exploitation likelihood.
Samsung Voice Recorder prior to 21.5.73.12 on Android 15 and prior to 21.5.81.40 on Android 16 exposes recorded audio files to unauthenticated attackers who have physical possession of a locked device. The flaw is an improper access control issue in lock-screen functionality, with EPSS at 0.17% (6th percentile) and no public exploit identified at time of analysis. Confidentiality impact is High, but the physical attack vector and need for device possession keep real-world risk low and confined to lost, stolen, or unattended devices.
Samsung Health versions prior to 6.30.5.105 allow a local attacker with low-level privileges to bypass authorization and read sensitive health data. The vulnerability requires a pre-existing local foothold, such as a malicious app, and impacts only confidentiality with no integrity or availability loss. With a low EPSS score of 0.12% and no public exploit identified, this is a moderate-severity local information disclosure rather than a widespread remote threat.
Local code execution with SystemUI privileges in Samsung Routines (versions prior to 4.8.7.1 on Android 15 and prior to 4.9.6.0 on Android 16) allows a locally installed app to execute arbitrary code with SystemUI privilege. Exploitation requires local access but no elevated privileges or user interaction, and the vulnerable component ships by default, so default configurations are at risk. No public exploit code or active exploitation has been identified, and EPSS is low at 0.14% (3rd percentile), indicating limited immediate threat.
Samsung Notes releases before 4.4.30.63 disclose the contents of shared notes to a malicious or colluding Android app running on the same device, because the application uses an implicit intent (rather than an explicit, package-targeted intent) to hand off shared-note data. Exploitation is strictly local: the victim must first install a hostile app that registers an intent filter matching the Notes sharing action, so default single-device usage with trusted apps is not exposed. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is only 0.11% (1st percentile), consistent with the low 3.3 CVSS score and confidentiality-only impact.
Tesla Telematics Control Unit (TCU) firmware releases prior to v2025.14 run the Android Debug Bridge daemon (adbd) as root and expose the vehicle's USB port externally, so an attacker with brief physical access can bypass the firmware's partial 'lockdown' state and use adb push/pull and adb forward to reach a writable location. From there, overwriting the kernel's uevent_helper or /proc/sys/kernel/hotplug entry yields arbitrary code execution as root on a device that controls in-vehicle telematics. The issue is unauthenticated (CVSS PR:N) and needs no user interaction, but it is fundamentally gated by in-person physical access to the exposed port, cannot be triggered remotely or at fleet scale, and no public exploit code has been identified at time of analysis; EPSS is 0.45% (37th percentile), consistent with a low-volume, access-constrained issue.
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains.
Hardcoded cryptographic key in Flock Safety DetectionProcessing app for ANPR. PoC available.
The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
Android versions up to 13.0 contains a vulnerability that allows attackers to bypass Carrier Relock (CVSS 4.6).
libimagecodec.quram.so in Android devices prior to the January 2026 Security Maintenance Release 1 contains an out-of-bounds read vulnerability that allows remote attackers to access sensitive memory without authentication. The vulnerability has a network attack vector with low complexity, enabling potential information disclosure through specially crafted input. No patch is currently available.
Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB. [CVSS 3.3 LOW]
Android versions up to 13.0 contains a vulnerability that allows attackers to access file with system privilege (CVSS 5.5).
Arbitrary code execution in Android's DualDAR component prior to the January 2026 security patch stems from a use-after-free memory vulnerability that can be exploited by local attackers with elevated privileges. An attacker with high-level device access could leverage this flaw to execute arbitrary code with system-level permissions. No patch is currently available, leaving affected devices vulnerable until the SMR January 2026 Release 1 update is deployed.
UI spoofing in the Chromium-based Microsoft Edge browser on Android lets a remote, unauthenticated attacker misrepresent browser interface elements so that victims believe they are viewing trusted content, which can be leveraged for phishing or social engineering. Exploitation requires the user to open attacker-controlled web content and interact with it (UI:R), and the attacker must satisfy specific rendering and timing conditions (AC:H); there is no data disclosure, no code execution, and no availability impact (C:N/I:L/A:N, CVSS 3.1). EPSS is 0.28% (18th percentile) and no public exploit code has been identified at time of analysis - this is a low-priority issue confined to the Android build listed in the CPE, not the desktop release.
Any third-party app already installed on a Transsion HiOS 14.0.0 handset can silently activate ADB debugging by sending an explicit Android intent to the exported, unprotected activity com.transsion.tranfacmode.entrance.main.MainActivity, with no user interaction and no prompt. Exploitation is local rather than remote - the attacker must first get a malicious or compromised application onto the device and running as an installed app, which is why our assessment rates the vector AV:L/AC:L/PR:N/UI:N and scores it 6.5 with limited confidentiality and integrity impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the underlying defect is missing authorization (CWE-862) on a system component that should never have been reachable from unprivileged third-party code.
UI spoofing in LINE for Android versions prior to 14.20 enables unauthenticated remote attackers to impersonate legitimate interfaces within the in-app browser, potentially leading to credential phishing. The vulnerability occurs because the full-screen security Toast notification, which normally displays the true origin of a web page, is not re-displayed when a user switches to another app and then returns to LINE, creating a window where a spoofed page can be presented. Exploitation requires user interaction (opening a malicious link and performing the app-switch sequence), and while no public exploit or active exploitation has been identified, the EPSS score is 0.18% (7th percentile).
UI spoofing in the LINE client for Android versions 13.8 through 15.5 allows a malicious page loaded in LINE's in-app browser to obscure the full-screen warning prompt using a crafted layout, enabling phishing-style deception of the user. The flaw is network-delivered and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) but requires the victim to open an attacker-supplied link and then trust and interact with the spoofed interface, so real-world exploitation depends entirely on successful social engineering. Impact is limited to integrity of the user's perception of a security warning (CWE-451); there is no code execution, data read, or denial of service, and no public exploit code or confirmed active exploitation was identified at time of analysis, with EPSS at 0.18% (7th percentile) indicating a low predicted likelihood of exploitation.
Domain spoofing in the toolbar of Google Chrome for Android before 143.0.7499.110 lets a remote, unauthenticated attacker deceive users about the true origin of a page by having them open a crafted HTML page. Exploitation requires the victim to actively navigate to the attacker's page (UI:R) and depends entirely on the user believing the spoofed address bar, so impact is limited to phishing facilitation rather than code execution, data theft, or session compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.27% (18th percentile); per Google's own rating this is a Medium-severity Chromium issue, and the vendor fix is available in version 143.0.7499.110.
Information disclosure in Brother iPrint&Scan for Android versions 6.13.7 and earlier occurs because the app stores application-specific files in an external cache directory that other apps on the same device can read. A malicious Android app already installed on the victim’s device could access those cached files, but exploitation is local, requires the victim to have installed the attacker’s app, and is limited to low confidentiality impact with no integrity, availability, or code-execution impact. No public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile), and this is a low-to-moderate priority information-disclosure issue rather than an urgent remote compromise.
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcd_handle_mcq_cq_events() and also in ufs_mtk_mcq_intr(). The following warning message will be generated when &hwq->cq_lock is used in IRQ context with IRQ enabled. Use ufshcd_mcq_poll_cqe_lock() with spin_lock_irqsave instead of spin_lock to resolve the deadlock issue. [name:lockdep&]WARNING: inconsistent lock state [name:lockdep&]-------------------------------- [name:lockdep&]inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [name:lockdep&]kworker/u16:4/260 [HC0[0]:SC0[0]:HE1:SE1] takes: ffffff8028444600 (&hwq->cq_lock){?.-.}-{2:2}, at: ufshcd_mcq_poll_cqe_lock+0x30/0xe0 [name:lockdep&]{IN-HARDIRQ-W} state was registered at: lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufs_mtk_mcq_intr+0x60/0x1bc [ufs_mediatek_mod] __handle_irq_event_percpu+0x140/0x3ec handle_irq_event+0x50/0xd8 handle_fasteoi_irq+0x148/0x2b0 generic_handle_domain_irq+0x4c/0x6c gic_handle_irq+0x58/0x134 call_on_irq_stack+0x40/0x74 do_interrupt_handler+0x84/0xe4 el1_interrupt+0x3c/0x78 <snip> Possible unsafe locking scenario: CPU0 ---- lock(&hwq->cq_lock); <Interrupt> lock(&hwq->cq_lock); *** DEADLOCK *** 2 locks held by kworker/u16:4/260: [name:lockdep&] stack backtrace: CPU: 7 PID: 260 Comm: kworker/u16:4 Tainted: G S W OE 6.1.17-mainline-android14-2-g277223301adb #1 Workqueue: ufs_eh_wq_0 ufshcd_err_handler Call trace: dump_backtrace+0x10c/0x160 show_stack+0x20/0x30 dump_stack_lvl+0x98/0xd8 dump_stack+0x20/0x60 print_usage_bug+0x584/0x76c mark_lock_irq+0x488/0x510 mark_lock+0x1ec/0x25c __lock_acquire+0x4d8/0xffc lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufshcd_poll+0x68/0x1b0 ufshcd_transfer_req_compl+0x9c/0xc8 ufshcd_err_handler+0x3bc/0xea0 process_one_work+0x2f4/0x7e8 worker_thread+0x234/0x450 kthread+0x110/0x134 ret_from_fork+0x10/0x20
In the Linux kernel, the following vulnerability has been resolved: kcsan: Avoid READ_ONCE() in read_instrumented_memory() Haibo Li reported: | Unable to handle kernel paging request at virtual address | ffffff802a0d8d7171 | Mem abort info:o: | ESR = 0x9600002121 | EC = 0x25: DABT (current EL), IL = 32 bitsts | SET = 0, FnV = 0 0 | EA = 0, S1PTW = 0 0 | FSC = 0x21: alignment fault | Data abort info:o: | ISV = 0, ISS = 0x0000002121 | CM = 0, WnR = 0 0 | swapper pgtable: 4k pages, 39-bit VAs, pgdp=000000002835200000 | [ffffff802a0d8d71] pgd=180000005fbf9003, p4d=180000005fbf9003, | pud=180000005fbf9003, pmd=180000005fbe8003, pte=006800002a0d8707 | Internal error: Oops: 96000021 [#1] PREEMPT SMP | Modules linked in: | CPU: 2 PID: 45 Comm: kworker/u8:2 Not tainted | 5.15.78-android13-8-g63561175bbda-dirty #1 | ... | pc : kcsan_setup_watchpoint+0x26c/0x6bc | lr : kcsan_setup_watchpoint+0x88/0x6bc | sp : ffffffc00ab4b7f0 | x29: ffffffc00ab4b800 x28: ffffff80294fe588 x27: 0000000000000001 | x26: 0000000000000019 x25: 0000000000000001 x24: ffffff80294fdb80 | x23: 0000000000000000 x22: ffffffc00a70fb68 x21: ffffff802a0d8d71 | x20: 0000000000000002 x19: 0000000000000000 x18: ffffffc00a9bd060 | x17: 0000000000000001 x16: 0000000000000000 x15: ffffffc00a59f000 | x14: 0000000000000001 x13: 0000000000000000 x12: ffffffc00a70faa0 | x11: 00000000aaaaaaab x10: 0000000000000054 x9 : ffffffc00839adf8 | x8 : ffffffc009b4cf00 x7 : 0000000000000000 x6 : 0000000000000007 | x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffffffc00a70fb70 | x2 : 0005ff802a0d8d71 x1 : 0000000000000000 x0 : 0000000000000000 | Call trace: | kcsan_setup_watchpoint+0x26c/0x6bc | __tsan_read2+0x1f0/0x234 | inflate_fast+0x498/0x750 | zlib_inflate+0x1304/0x2384 | __gunzip+0x3a0/0x45c | gunzip+0x20/0x30 | unpack_to_rootfs+0x2a8/0x3fc | do_populate_rootfs+0xe8/0x11c | async_run_entry_fn+0x58/0x1bc | process_one_work+0x3ec/0x738 | worker_thread+0x4c4/0x838 | kthread+0x20c/0x258 | ret_from_fork+0x10/0x20 | Code: b8bfc2a8 2a0803f7 14000007 d503249f (78bfc2a8) ) | ---[ end trace 613a943cb0a572b6 ]----- The reason for this is that on certain arm64 configuration since e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y"), READ_ONCE() may be promoted to a full atomic acquire instruction which cannot be used on unaligned addresses. Fix it by avoiding READ_ONCE() in read_instrumented_memory(), and simply forcing the compiler to do the required access by casting to the appropriate volatile type. In terms of generated code this currently only affects architectures that do not use the default READ_ONCE() implementation. The only downside is that we are not guaranteed atomicity of the access itself, although on most architectures a plain load up to machine word size should still be atomic (a fact the default READ_ONCE() still relies on itself).
The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect before 25.12 on desktop, KDE Connect before 0.5.4 on iOS, KDE Connect before 1.34.4 on Android, GSConnect before 68, and Valent before 1.0.0.alpha.49.
A security vulnerability in the KDE Connect information-exchange protocol (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
A security vulnerability in KDE Connect (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v2.2.5.
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.
In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117735; Issue ID: MSV-4539.
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4752.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184297; Issue ID: MSV-4759.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4796.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4797.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
CVE-2025-20771 is a security vulnerability (CVSS 6.7). Remediation should follow standard vulnerability management procedures.
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4803.
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4804.
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.
In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4807.
CVE-2025-20766 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation.
In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.
In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10259774; Issue ID: MSV-5029.
In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267218; Issue ID: MSV-5032.
Improper verification of the source of a communication channel in Samsung SmartTouchCall prior to version 1.0.1.1 lets a remote, unauthenticated attacker spoof a trusted communication origin and read sensitive information, but the victim must actively interact with the crafted communication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 6.5). Exploitation is constrained by the mandatory user-interaction step and the app-specific attack surface, and no public exploit has been identified at time of analysis; EPSS is 0.05% (17th percentile) and the issue is not in CISA KEV, marking it as moderate rather than urgent. Impact is limited to confidentiality - there is no integrity or availability effect.
Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory.
Information disclosure in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated remote attackers to read memory outside the bounds of the parsing buffer when a crafted malformed image is decoded, affecting Android 13, 14, 15 and 16 firmware prior to SMR Dec-2025 Release 1. Samsung and NVD rate the flaw 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while our assessment treats it as requiring user interaction (UI:R) with low confidentiality impact (C:L), since the leak is bounded to memory adjacent to the parsing buffer and is most useful as a primitive chained with another bug. No public exploit code has been identified at time of analysis and EPSS is low (0.06%, 17th percentile), so broad exploitation is unlikely without a companion memory-corruption flaw.
Samsung Android 13, 14, 15, and 16 devices running firmware prior to SMR Dec-2025 Release 1 contain an out-of-bounds memory access flaw in the Quram-supplied image decoder libimagecodec.quram.so, reachable by remote unauthenticated attackers who supply a crafted image for parsing. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5), the confirmed impact is high confidentiality loss only, consistent with out-of-bounds read/disclosure rather than confirmed code execution, and no single-click user interaction is strictly required for the vulnerable decode path. Exploitation is currently limited by the low EPSS score (0.07%, 22nd percentile), no public exploit code and no confirmed active exploitation (not in CISA KEV), and the practical need to route a malicious image into the specific vulnerable codec, for example via message attachment or thumbnail auto-decoding.
Opening or previewing a maliciously crafted image on an unpatched Samsung Android device can force the Quram image codec (libimagecodec.quram.so) to read out-of-bounds memory while parsing an IFD (EXIF/TIFF) tag, disclosing memory contents to a remote attacker. The flaw affects Samsung Android 13, 14, 15, and 16 builds below patch level SMR Dec-2025 Release 1, is reachable without authentication (PR:N) but is gated by mandatory user interaction (UI:R) since the victim must receive and render the image, and its assessed impact is confidentiality-only (C:H/I:N/A:N, CVSS 6.5 Medium). EPSS is low at 0.07% (22nd percentile) and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the Samsung Android bootloader allows an attacker with physical possession of and hands-on access to an affected device to read out-of-bounds memory from the bootloader stage. Only devices running firmware builds below the SMR Dec-2025 Release 1 patch level (spanning Android 13, 14, 15 and 16 per the vendor advisory) are affected, and the physical-access prerequisite (CVSS AV:P, unauthenticated per PR:N, no user interaction per UI:N) is the decisive limiter - there is no remote or network exploitation path. Impact is confidentiality-only (C:H with I:N/A:N) with no described code-execution primitive, no public exploit code and no confirmed active exploitation (CISA KEV not listed); EPSS is 0.02% (6th percentile), consistent with a low real-world priority issue.
Improper export of the Dynamic Lockscreen component on Samsung Android devices allows an app already installed and running on the phone to access files with Dynamic Lockscreen's privileges, producing high confidentiality and integrity impact on the data it exposes. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1): the attacker must be able to install and run a low-privilege malicious app, after which no further user interaction is required, and there is no remote or network exploitation path. No public exploit code has been identified at time of analysis and EPSS is negligible (0.02%, 4th percentile), but the flaw is remediated only by Samsung's SMR Dec-2025 Release 1 update, so devices still on patch levels up to SMR Nov-2025 R1 remain vulnerable.
An out-of-bounds write in the fingerprint trustlet's metadata-decoding routine affects Samsung Android devices running Android 13 through 16 that have not yet received the SMR Dec-2025 Release 1 maintenance patch. Exploitation requires an attacker to already hold a privileged local foothold on the device (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) - there is no remote path and no unprivileged-app path - and the assessed impact is integrity-only within the trustlet's security scope, with no confidentiality or availability effect. Severity is low: EPSS is 0.02% (4th percentile), no public exploit code and no confirmed active exploitation were identified at time of analysis, making the pre-existing privileged local access the dominant limiting factor rather than the memory-corruption class itself.
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed
Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Inefficient regular expression complexity (ReDoS) in Zoom Workplace Client and Zoom Meeting SDK builds for Android and iOS earlier than 6.5.10 allows a remote, unauthenticated attacker to force the client to process crafted input through a vulnerable regular-expression code path, causing excessive CPU consumption and potential client unavailability; no user interaction is required per the CVSS vector (AV:N/PR:N/UI:N). The NVD score of 9.8 (C:H/I:H/A:H) overstates impact relative to the underlying CWE-1333 weakness - our independent assessment re-scores this as availability-only (C:N/I:N/A:H) - and the public description's claim of 'escalation of privilege' is not supported by the ReDoS root cause; treat the privilege-escalation framing with caution. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.12% (31st percentile), indicating limited near-term exploitation likelihood despite the high headline score.
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and AnyDesk for Android before 8.0.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in AnyDesk for Windows before 9.0.6 and AnyDesk for Android before 8.0.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.
Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. Rated medium severity (CVSS 5.7). No vendor patch available.
In charger, there is a possible out of bounds write due to a missing bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
In apusys, there is a possible memory corruption due to use after free. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In pda, there is a possible escalation of privilege due to use after free. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In clkdbg, there is a possible escalation of privilege due to use after free. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
In preloader, there is a possible escalation of privilege due to an insecure default value. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Google Messages running as the default SMS/MMS/RCS application on Wear OS smartwatches can be induced to silently send text or multimedia messages to arbitrary recipients on the user's behalf, without SMS permissions and, per the vendor description, without further user interaction. Exploitation is not remote in practice: it requires a Wear OS device configured with Google Messages as the default messaging app plus an already-present malicious or compromised app capable of firing Android intents, a local foothold rather than a network-reachable entry point, and the vendor vector's UI:P (passive interaction) marking further limits how fully silent the attack can be. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; EPSS is negligible at 0.14% (3rd percentile), and the overall picture is a medium-severity, low-urgency issue confined to the Wear OS platform.
Out-of-bounds write in Samsung Notes' SPI decoder affects versions prior to 4.4.30.63 and allows a local low-privileged attacker, typically a separate malicious or compromised app, to corrupt memory by supplying a crafted SPI-format file. The CVSS vector requires local access and low privileges (AV:L/PR:L) with no user interaction (UI:N), and impact is limited to integrity (I:H) with no confidentiality or availability effect. There is no KEV listing and no public exploit identified at time of analysis; EPSS is 0.12% (2nd percentile), making this a moderate, low-priority issue rather than an urgent one.
Out-of-bounds memory disclosure in Samsung Notes prior to 4.4.30.63 allows local attackers with low privileges to read beyond allocated buffers when parsing crafted images, potentially leaking sensitive data. The attack requires user interaction to open the malicious image, and while it has high confidentiality impact, availability impact is low. This vendor-reported issue (mobile.security@samsung.com) has no public exploit code or active exploitation identified at time of analysis.
An out-of-bounds read (CWE-125) in how Samsung Notes parses image data allows a locally positioned attacker to read past the end of an allocated buffer and expose out-of-bounds memory contents; versions prior to 4.4.30.63 are affected. Exploitation requires a pre-existing low-privilege foothold on the device - a malicious installed app or the ability to get a crafted image opened in Notes - with no network attack path and no user interaction required once that foothold exists (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). The impact is confidentiality-focused memory disclosure rather than code execution or a write primitive; there is no public exploit identified at time of analysis, CISA KEV does not list it, and EPSS is only 0.12% (2nd percentile), so this is a genuine but comparatively low-urgency issue that is fully resolved by updating to 4.4.30.63 or later.
Out-of-bounds read in Samsung Notes' image-buffer allocation path lets a locally installed, low-privileged app read adjacent process memory on all builds prior to 4.4.30.63. Exploitation requires local code execution with low privileges (PR:L per the assessed CVSS vector) and no user interaction, and the outcome is bounded to information disclosure of out-of-bounds memory rather than code execution, with at most a Low availability impact from a possible app crash. Our assessment rates this as a genuinely mid-tier issue: the strictly local attack surface heavily constrains real-world risk compared with the vendor's 7.1 score, EPSS is only 0.12% (2nd percentile), and no public exploit identified at time of analysis; confirmed actively exploited status has not been established (no CISA KEV listing).
Out-of-bounds read in the SPI decoder of Samsung Notes prior to version 4.4.30.63 allows local attackers with low-level privileges to access out-of-bounds memory, potentially causing information disclosure and availability impact. This moderate-severity, low-urgency vulnerability requires local access (no remote vector) and no user interaction, and is limited to devices with the vulnerable app. No public exploit code exists, and the EPSS score is very low (0.12%, 2nd percentile), indicating minimal exploitation likelihood.
Samsung Voice Recorder prior to 21.5.73.12 on Android 15 and prior to 21.5.81.40 on Android 16 exposes recorded audio files to unauthenticated attackers who have physical possession of a locked device. The flaw is an improper access control issue in lock-screen functionality, with EPSS at 0.17% (6th percentile) and no public exploit identified at time of analysis. Confidentiality impact is High, but the physical attack vector and need for device possession keep real-world risk low and confined to lost, stolen, or unattended devices.
Samsung Health versions prior to 6.30.5.105 allow a local attacker with low-level privileges to bypass authorization and read sensitive health data. The vulnerability requires a pre-existing local foothold, such as a malicious app, and impacts only confidentiality with no integrity or availability loss. With a low EPSS score of 0.12% and no public exploit identified, this is a moderate-severity local information disclosure rather than a widespread remote threat.
Local code execution with SystemUI privileges in Samsung Routines (versions prior to 4.8.7.1 on Android 15 and prior to 4.9.6.0 on Android 16) allows a locally installed app to execute arbitrary code with SystemUI privilege. Exploitation requires local access but no elevated privileges or user interaction, and the vulnerable component ships by default, so default configurations are at risk. No public exploit code or active exploitation has been identified, and EPSS is low at 0.14% (3rd percentile), indicating limited immediate threat.
Samsung Notes releases before 4.4.30.63 disclose the contents of shared notes to a malicious or colluding Android app running on the same device, because the application uses an implicit intent (rather than an explicit, package-targeted intent) to hand off shared-note data. Exploitation is strictly local: the victim must first install a hostile app that registers an intent filter matching the Notes sharing action, so default single-device usage with trusted apps is not exposed. There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is only 0.11% (1st percentile), consistent with the low 3.3 CVSS score and confidentiality-only impact.
Tesla Telematics Control Unit (TCU) firmware releases prior to v2025.14 run the Android Debug Bridge daemon (adbd) as root and expose the vehicle's USB port externally, so an attacker with brief physical access can bypass the firmware's partial 'lockdown' state and use adb push/pull and adb forward to reach a writable location. From there, overwriting the kernel's uevent_helper or /proc/sys/kernel/hotplug entry yields arbitrary code execution as root on a device that controls in-vehicle telematics. The issue is unauthenticated (CVSS PR:N) and needs no user interaction, but it is fundamentally gated by in-person physical access to the exposed port, cannot be triggered remotely or at fleet scale, and no public exploit code has been identified at time of analysis; EPSS is 0.45% (37th percentile), consistent with a low-volume, access-constrained issue.
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains.
Hardcoded cryptographic key in Flock Safety DetectionProcessing app for ANPR. PoC available.
The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.
The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.