Threat database

CVE-2026-58765 is a vulnerability in the GPU component of Google Android caused by a logic error that allows a permission bypass. This flaw can lead to local privilege escalation, granting System execution privileges without requiring user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.7.

CVE-2026-58755 is a local elevation of privilege vulnerability in the smmu_install_nested_ste function of arm-smmu-v3.c in Google Android. The flaw arises from a logic error that could allow an attacker with system execution privileges to escalate their privileges further. Exploitation does not require user interaction. The vulnerability has a CVSS score of 6.7, indicating medium severity.

CVE-2026-58751 is a use-after-free vulnerability in multiple functions of arm-smmu-v3.c within Google Android. It allows local attackers with system execution privileges to escalate their privileges without requiring user interaction. The vulnerability is due to a logic error in the code.

CVE-2026-58747 is an elevation of privilege vulnerability in the smmu_detach_dev function of arm-smmu-v3.c in Google Android. The flaw arises from a logic error that allows a permission bypass, enabling a local attacker with system execution privileges to escalate their privileges without requiring user interaction. The vulnerability has a CVSS score of 6.7, indicating a medium severity level.

CVE-2026-58744 is a high-severity elevation of privilege vulnerability in Google Android. It arises from improper input validation in multiple locations, allowing local attackers to escalate privileges without needing additional execution rights or user interaction.

CVE-2026-58739 is an elevation of privilege vulnerability in Google Android occurring in the platform_msg_handler_init function of default_msg_handlers.c. The issue is described as a confused deputy problem that could allow a local attacker with system execution privileges to escalate their privileges without requiring user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.7.

CVE-2026-58734 is a high-severity elevation of privilege vulnerability in Google Android. It arises from a race condition causing a possible out-of-bounds write in the function google_mba_recv_msg within google_mba_poll.c. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-58731 is an information disclosure vulnerability in Google Android caused by a possible out-of-bounds read in multiple functions of physmem_extmem_linux.c due to uninitialized data. Exploitation does not require user interaction or additional privileges. The vulnerability has a medium severity rating with a CVSS score of 6.2.

CVE-2026-58728 is a high-severity elevation of privilege vulnerability in Google Android. It arises from a race condition in the ARM64_TLBI function within mmu.h, potentially causing memory corruption. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-58726 is an elevation of privilege vulnerability in Google Android. It occurs due to a missing permission check in the FsmReleaseKey function of fsm.c, allowing a local attacker with system execution privileges to bypass permissions. Exploitation does not require user interaction. The vulnerability has a CVSS score of 6.7, indicating medium severity.

CVE-2026-58724 is a high-severity elevation of privilege vulnerability in Google Android caused by a use-after-free condition due to a race condition in multiple locations. Exploitation requires local access with system execution privileges and does not require user interaction.

In multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58718 is an elevation of privilege vulnerability in the smmu_detach_dev_nested function of arm-smmu-v3.c in Google Android. It arises from improper input validation, potentially allowing a local attacker with system execution privileges to escalate their privileges further. Exploitation does not require user interaction.

CVE-2026-58716 is a local elevation of privilege vulnerability in Google Android caused by a race condition leading to a time-of-check to time-of-use (TOCTOU) issue. Exploitation requires System execution privileges but no user interaction. The vulnerability could allow an attacker with certain privileges to escalate their access rights. The CVSS score is 6.7, indicating a medium severity level.

CVE-2026-58710 is a high-severity vulnerability in Google Android involving an out-of-bounds write in the DecodeFilmGrainParams function of film_grain_dec.cc. This flaw allows remote code execution without requiring user interaction or additional privileges.

In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58701 is a high-severity elevation of privilege vulnerability in Google Android. It arises from a possible out-of-bounds write in the trusty_dputc function of generic-arm64-smcall.c due to a race condition. Exploitation requires local access with system execution privileges and does not require user interaction.

In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58698 is an elevation of privilege vulnerability in Google Android. It involves a permission bypass in the ap_pmic_poll_msg_handler function of ap_pmic_ipc.c due to a confused deputy issue. Exploitation requires local access with System execution privileges and does not require user interaction. The vulnerability has a medium severity with a CVSS score of 6.7.

In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.