tag
Android
Dolby Unified (DDPlus) Decoder Out-of-Bounds Write via Evolution Data (CVE-2025-54957)
CVE-2025-54957 is a critical out-of-bounds write vulnerability in Dolby's DDPlus Unified Decoder, triggered while processing "evolution" data in an AC-3/EC-3 (Dolby Digital Plus) bitstream. An integer overflow in the length calculation for evolution-data…
Samsung SveService Native Out-of-Bounds Write (CVE-2026-21018)
CVE-2026-21018 is an out-of-bounds write in the Samsung system service SveService, which runs as system (UID 1000) and is registered directly via ServiceManager.addService() — bypassing Android's normal signatureOrSystem permission enforcement, so it is…
Samsung Android AT-Command Filter Bypass to system_server Code Execution (CVE-2026-20980)
CVE-2026-20980 is the first stage of a three-bug exploit chain against Samsung's AP AT-command handling. The atdistributor daemon filters "protected" AT commands via libpacmclient.so's pacmcheckatcmds, which rejects multi-command payloads by checking for the…
Linux Kernel Futex-PI rtmutex remove_waiter() Use-After-Free (CVE-2026-43499)
CVE-2026-43499 is a use-after-free in the Linux kernel's removewaiter() function (kernel/locking/rtmutex.c), which is shared between the ordinary rtmutex slow-unlock path and the futex priority-inheritance (PI) proxy-lock rollback path invoked from…
libopenapv / Android APV Codec Zero-Click Heap Buffer Overflow (CVE-2026-0006)
The APV decoder in libopenapv parses two different structures — an AUINFO PBU (Payload Byte Unit) and the actual FRAME PBU — to determine frame dimensions, but oapvdinfo() and oapvddecode() read those dimensions from different sources without cross-validating…
EcoOnline EHS Android App — Deep Link Validation Bypass to WebView Open Redirect (CVE-2026-26897)
EcoOnline EHS for Android is a WebView wrapper app that loads its content from a trusted domain and enforces a host allow-list (isInternalHost) whenever it restores or navigates URLs. The app also registers an exported, scheme-only custom URL handler…
Android ActivityManagerService dumpBitmapsProto() Missing Permission Check (CVE-2026-0047)
ActivityManagerService.dumpBitmapsProto() is missing an enforceCallingOrSelfPermission(DUMP) check that should gate access to a system-wide UI bitmap dump used for debugging. Because the method body executes fully before any permission is verified, any…
BlueDucky — Unauthenticated Peering Leading to Code Execution (CVE-2023-45866)
BlueDucky is a practical PoC implementation for CVE-2023-45866. It automates Bluetooth device discovery/selection and then emulates HID keyboard input to inject attacker-controlled DuckyScript payloads on vulnerable nearby targets. Because the pairing…