Google Android Mobile operating system

In engineermode service, there is a possible command injection due to improper input validation

CVE-2025-31710 8.4 - High - June 03, 2025

In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.

In cplog service, there is a possible system crash due to null pointer dereference

CVE-2025-31711 6.2 - Medium - June 03, 2025

In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additional execution privileges needed.

In cplog service, there is a possible out of bounds write due to a missing bounds check

CVE-2025-31712 6.2 - Medium - June 03, 2025

In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

CVE-2025-27029 7.5 - High - June 03, 2025

Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.

Buffer Over-read

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

CVE-2024-53026 8.2 - High - June 03, 2025

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

Buffer Over-read

Information disclosure may occur while processing goodbye RTCP packet

CVE-2024-53021 8.2 - High - June 03, 2025

Information disclosure may occur while processing goodbye RTCP packet from network.

Buffer Over-read

Information disclosure may occur while decoding the RTP packet with invalid header extension

CVE-2024-53020 8.2 - High - June 03, 2025

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

Buffer Over-read

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

CVE-2024-53019 8.2 - High - June 03, 2025

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Buffer Over-read

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

CVE-2024-53010 7.8 - High - June 03, 2025

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

Authorization

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

CVE-2025-21486 7.8 - High - June 03, 2025

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

Untrusted Pointer Dereference

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

CVE-2025-21485 7.8 - High - June 03, 2025

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

TOCTTOU

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver

CVE-2025-0819 - June 02, 2025

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p3, from r50p0 through r54p0.

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver

CVE-2025-0073 - June 02, 2025

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory.This issue affects Valhall GPU Kernel Driver: from r53p0 before r54p0; Arm 5th Gen GPU Architecture Kernel Driver: from r53p0 before r54p0.

Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55

CVE-2025-5066 - May 27, 2025

Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualised GPU memory.

CVE-2024-47893 - May 17, 2025

Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to read and/or write data outside the Guest's virtualised GPU memory.

Memory corruption while processing a data structure

CVE-2025-21453 7.8 - High - May 06, 2025

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Dangling pointer

Transient DOS while parsing per STA profile in ML IE.

CVE-2025-21459 7.5 - High - May 06, 2025

Transient DOS while parsing per STA profile in ML IE.

Out-of-bounds Read

Memory corruption while reading the FW response

CVE-2025-21467 7.8 - High - May 06, 2025

Memory corruption while reading the FW response from the shared queue.

Memory Corruption

Memory corruption while reading response

CVE-2025-21468 7.8 - High - May 06, 2025

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

Memory Corruption

Memory corruption while reading secure file.

CVE-2024-49835 7.8 - High - May 06, 2025

Memory corruption while reading secure file.

Memory Corruption

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

CVE-2024-49847 7.5 - High - May 06, 2025

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Out-of-bounds Read

Memory corruption while decoding of OTA messages

CVE-2024-49846 9.1 - Critical - May 06, 2025

Memory corruption while decoding of OTA messages from T3448 IE.

Out-of-bounds Read

Memory corruption during the FRS UDS generation process.

CVE-2024-49845 7.8 - High - May 06, 2025

Memory corruption during the FRS UDS generation process.

Memory Corruption

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

CVE-2024-49842 7.8 - High - May 06, 2025

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

Authorization

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

CVE-2024-49841 7.8 - High - May 06, 2025

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

Improper Handling of Exceptional Conditions

In Modem, there is a possible system crash due to an uncaught exception

CVE-2025-20666 7.5 - High - May 05, 2025

In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00650610; Issue ID: MSV-2933.

assertion failure

In scp, there is a possible out of bounds write due to a missing bounds check

CVE-2025-20668 7.8 - High - May 05, 2025

In scp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09625562; Issue ID: MSV-3027.

Memory Corruption

In thermal, there is a possible out of bounds write due to a race condition

CVE-2025-20671 7 - High - May 05, 2025

In thermal, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09698599; Issue ID: MSV-3228.

Memory Corruption

In devinfo, there is a possible information disclosure due to a missing SELinux policy

CVE-2025-20665 5.5 - Medium - May 05, 2025

In devinfo, there is a possible information disclosure due to a missing SELinux policy. This could lead to local information disclosure of device identifier with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09555228; Issue ID: MSV-2760.

Insertion of Sensitive Information into Externally-Accessible File or Directory

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver

CVE-2025-0072 7.8 - High - May 02, 2025

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to already freed memory. This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p3, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p3, from r50p0 through r53p0.

Dangling pointer

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver

CVE-2025-0427 7.8 - High - May 02, 2025

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r8p0 through r49p3, from r50p0 through r51p0; Valhall GPU Kernel Driver: from r19p0 through r49p3, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p3, from r50p0 through r53p0.

Dangling pointer

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver

CVE-2025-0050 - April 07, 2025

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to make valid GPU processing operations, including via WebGL or WebGPU, to access a limited amount outside of buffer bounds.This issue affects Bifrost GPU Userspace Driver: from r0p0 through r49p2, from r50p0 through r51p0; Valhall GPU Userspace Driver: from r19p0 through r49p2, from r50p0 through r53p0; Arm 5th Gen GPU Architecture Userspace Driver: from r41p0 through r49p2, from r50p0 through r53p0.

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

CVE-2025-21434 7.5 - High - April 07, 2025

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

Buffer Over-read

Memory corruption while handling file descriptor during listener registration/de-registration.

CVE-2024-43066 7.8 - High - April 07, 2025

Memory corruption while handling file descriptor during listener registration/de-registration.

Dangling pointer

Memory corruption while processing multiple IOCTL calls

CVE-2024-49848 6.7 - Medium - April 07, 2025

Memory corruption while processing multiple IOCTL calls from HLOS to DSP.

Dangling pointer

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

CVE-2025-21429 7.5 - High - April 07, 2025

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Buffer Over-read

Transient DOS while connecting STA to AP and initiating ADD TS request

CVE-2025-21430 7.5 - High - April 07, 2025

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Buffer Over-read

Transient DOS may occur while parsing SSID in action frames.

CVE-2025-21448 7.5 - High - April 07, 2025

Transient DOS may occur while parsing SSID in action frames.

Buffer Over-read

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet

CVE-2024-45552 8.2 - High - April 07, 2025

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.

Buffer Over-read

Information disclosure while creating MQ channels.

CVE-2024-45549 7.7 - High - April 07, 2025

Information disclosure while creating MQ channels.

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Cryptographic issues while generating an asymmetric key pair for RKP use cases.

CVE-2024-43065 7.1 - High - April 07, 2025

Cryptographic issues while generating an asymmetric key pair for RKP use cases.

Exposed Dangerous Method or Function

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes

CVE-2024-45551 6.2 - Medium - April 07, 2025

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

1390

Transient DOS may occur while parsing extended IE in beacon.

CVE-2025-21435 7.5 - High - April 07, 2025

Transient DOS may occur while parsing extended IE in beacon.

Buffer Over-read

Memory corruption while assigning memory

CVE-2024-33058 7.5 - High - April 07, 2025

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

Insufficient Granularity of Access Control

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes

CVE-2025-21436 7.8 - High - April 07, 2025

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.

Dangling pointer

In keymaster, there is a possible out of bounds read due to a missing bounds check

CVE-2025-20655 - April 07, 2025

In keymaster, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04427687; Issue ID: MSV-3183.

Out-of-bounds Read

In DA, there is a possible permission bypass due to a logic error

CVE-2025-20658 - April 07, 2025

In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.

Memory Corruption

In PlayReady TA, there is a possible out of bounds read due to a missing bounds check

CVE-2025-20660 - April 07, 2025

In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: DTV04436357; Issue ID: MSV-3186.

Out-of-bounds Read

In DA, there is a possible out of bounds write due to a missing bounds check

CVE-2025-20656 - April 07, 2025

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423; Issue ID: MSV-3033.

Memory Corruption

In vdec, there is a possible permission bypass due to improper input validation

CVE-2025-20657 - April 07, 2025

In vdec, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09486425; Issue ID: MSV-2609.

Memory Corruption