2023

In on_remove_iso_data_path of btm_iso_impl.h, there is a possible out of bounds read due to improper input validation. T

In btu_ble_proc_ltk_req of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could

In remove_sdp_record of btif_sdp_server.cc, there is a possible out of bounds read due to a missing bounds check. This c

In btm_acl_process_sca_cmpl_pkt of btm_acl.cc, there is a possible out of bounds read due to an incorrect bounds check.

In btm_ble_batchscan_filter_track_adv_vse_cback of btm_ble_batchscan.cc, there is a possible out of bounds read due to a

In btm_ble_periodic_adv_sync_tx_rcvd of btm_ble_gap.cc, there is a possible out of bounds read due to an incorrect bound

In gatt_dbg_op_name of gatt_utils.cc, there is a possible out of bounds read due to a missing bounds check. This could l

In VideoFrame of VideoFrame.h, there is a possible abort due to an integer overflow. This could lead to remote informati

In setInputMethodWithSubtypeIdLocked of InputMethodManagerService.java, there is a possible way to setup input methods t

In fixNotification of NotificationManagerService.java, there is a possible bypass of notification hide preference due to

In btm_acl_encrypt_change of btm_acl.cc, there is a possible way for a remote device to turn off encryption without resu

In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in th

In btm_ble_update_inq_result of btm_ble_gap.cc, there is a possible out of bounds read due to a heap buffer overflow. Th

In onCreate of UsbAccessoryUriActivity.java, there is a possible way to escape the Setup Wizard due to a logic error in

In LogResponse of Dns.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remo

In multiple functions of WifiNetworkFactory.java, there is a missing permission check. This could lead to local escalati

In getCurrentPrivilegedPackagesForAllUsers of CarrierPrivilegesTracker.java, there is a possible permission bypass due t

In ForegroundUtils of ForegroundUtils.java, there is a possible way to read NFC tag data while the app is still in the b

In Exynos_parsing_user_data_registered_itu_t_t35 of VendorVideoAPI.cpp, there is a possible out of bounds read due to a

In btm_ble_update_inq_result of btm_ble_gap.cc, there is a possible out of bounds read due to a heap buffer overflow. Th

In xmlParseTryOrFinish of parser.c, there is a possible out of bounds read due to a heap buffer overflow. This could lea

In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due

In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to

In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interact

In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This co

In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due t

In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits du

In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to

In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin u

In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel informati

In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds che

In inviteInternal of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea

In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could

In setProfileName of DevicePolicyManagerService.java, there is a possible way to crash the SystemUI menu due to a missin

In Parse of simdata.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local

In BuildSetTcsFci of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a heap buffer overflow. This

In Parse of simdata.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local

In encode of miscdata.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to loca

In encode of wlandata.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loc

In BuildGetRadioNode of protocolmiscbulider.cpp, there is a possible out of bounds read due to improper input validation

In BuildSetRadioNode of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a missing null check. Thi

In StoreAdbSerialNumber of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a missing bounds check

In Do_AIMS_SET_CALL_WAITING of imsservice.cpp, there is a possible out of bounds read due to a missing bounds check. Thi

In FaceStatsAnalyzer::InterpolateWeightList of face_stats_analyzer.cc, there is a possible out of bounds read due to a m

In the Google BMS kernel module, there is a possible out of bounds write due to a heap buffer overflow. This could lead

In handle_set_parameters_ctrl of hal_socket.c, there is a possible out of bounds read due to an incorrect bounds check.

In registerGsmaServiceIntentReceiver of ShannonRcsService.java, there is a possible way to activate/deactivate RCS servi

In BuildSetConfig of protocolimsbuilder.cpp, there is a possible out of bounds read due to a missing null check. This co

In lwis_i2c_device_disable of lwis_device_i2c.c, there is a possible UAF due to a logic error in the code. This could le

there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with