Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt

Hoch 7.8Android

In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to an…

CVE-2026-5869010. Nov 2026

In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code.

CVE-2026-5868410. Nov 2026

In smmu_config_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Kritisch 9.8Android

In multiple locations, there is a possible out-of-bounds write due to an integer overflow.

CVE-2026-5868110. Nov 2026

In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 6.7Android

In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure.

CVE-2026-5868010. Nov 2026

In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 6.8Android

In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error.

CVE-2026-5867710. Nov 2026

In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 6.7Android

In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code.

CVE-2026-5704810. Nov 2026

In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Kritisch 9.8Android

In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check.

CVE-2026-5704710. Nov 2026

In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 6.7Android

In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error.

CVE-2026-5704310. Nov 2026

In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In getChppAppState of chpp_init.cc, there is a possible way to trigger an out of bounds read and corrupt task control structures due to a missing permission…

CVE-2026-5703710. Nov 2026

In getChppAppState of chpp_init.cc, there is a possible way to trigger an out of bounds read and corrupt task control structures due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the code.

CVE-2026-5703610. Nov 2026

In send_vdu_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Kritisch 9.8Android

In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code.

CVE-2026-5701010. Nov 2026

In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code.

CVE-2026-5700910. Nov 2026

In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.8Android

In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy.

CVE-2026-5700510. Nov 2026

In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a missing bounds check.

CVE-2026-5700410. Nov 2026

In PresenceDecoderV1::DecodeDataElements of presence_decoder_v1.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 6.7Android

In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption.

CVE-2026-5699510. Nov 2026

In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an integer overflow.

CVE-2026-5698010. Nov 2026

In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Kritisch 9.8Android

In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code.

CVE-2026-5697110. Nov 2026

In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code.

CVE-2026-5696910. Nov 2026

In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory due to a confused…

CVE-2026-5696610. Nov 2026

In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 5.3Android

In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code.

CVE-2026-5695610. Nov 2026

In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a possible way to leak host code pointers to a guest virtual…

CVE-2026-5695110. Nov 2026

In on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a possible way to leak host code pointers to a guest virtual machine due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 4.0Android

In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy.

CVE-2026-5694710. Nov 2026

In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 6.7Android

In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error.

CVE-2026-5694610. Nov 2026

In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a…

CVE-2026-5694410. Nov 2026

In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Niedrig 2.3Android

In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check.

CVE-2026-5694310. Nov 2026

In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.0Android

In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition.

CVE-2026-5693810. Nov 2026

In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Mittel 4.0Android

In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error.

CVE-2026-5693510. Nov 2026

In km_os_regen_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code.

CVE-2026-5693410. Nov 2026

In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 7.8Android

In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow.

CVE-2026-5693310. Nov 2026

In RecordApTx of efw_ap_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

Original bei AndroidAlle Quellen (2)

Hoch 8.4Android

In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream identifiers due to a confused deputy.

CVE-2026-5693010. Nov 2026

In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream identifiers due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Original bei AndroidAlle Quellen (2)