CVE Database

In max_num_ref_frames of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with …

In mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping size truncation due to an …

In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure …

In smmu_get_mair_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a logic error. This …

In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers due to uninitialized data. …

In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. This could lead to local escalation of privilege with …

In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission check. …

In Retry_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leaked message objects due to a logic error. This could lead …

In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure …

In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This …

In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory declaration due to …

In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. This could lead to local information …

In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassigned stream identifiers due to a logic error. This …

In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption. This could lead to remote code …

In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. This could …

In multiple functions of cn_Tai.cpp, there is a possible way to trigger an out of bounds write due to memory corruption. This could lead to …

In register_dump_dpa of sswrp_pcie.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure …

In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast receivers due to a missing permission check. …

In pic_timing of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with …

In CMD_ENC_SET_PARAM of encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with …

In s_gen_tile_param of multiple files, there is a possible way to trigger an out of bounds write in tile parameter arrays due to an incorrect …

In stpropnci_process_std of stpropnci_std.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. …

In chppWifiRangingEventNotification of clients/wifi.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote (proximal/adjacent) …

In cnm_memset of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with …

In update_user_consent of main.rs, there is a possible elevation of privilege due to uninitialized data. This could lead to local escalation of privilege with System …

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of …

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of …

In HostLinkBase::chreIpiHandler of host_link.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with …

In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no …

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege …

In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges …

In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution …

In ac_get_prot_config of plat_trusty.c, there is a possible memory corruption due to improper input validation. This could lead to local information disclosure with System execution …

In mfc_alloc_enc_roi_buffer of mfc_buf.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with …

In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This could lead to local denial of service with no …

In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with User …

In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response queue due to a …

In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System …

In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote escalation …

In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. …

In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional …

In codec3p_secure of codec3p_secure, there is a possible Heap Buffer Overflow due to a missing bounds check. This could lead to local escalation of privilege …

In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System …

In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to …

In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of …

In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution …

In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. This could lead to local escalation of privilege with …

In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. This could lead …

In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code. This could lead to local …

In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no …