Threat database

CVE-2026-56974 is a high-severity elevation of privilege vulnerability in Google Android. It involves an out-of-bounds write in the AudioRtpPayloadEncoderNode.cpp component due to improper input validation. Exploitation requires user interaction and could lead to remote code execution without needing additional privileges.

In multiple locations, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56972 is a medium severity elevation of privilege vulnerability in Google Android caused by an out-of-bounds write due to incorrect bounds checking in multiple locations. Exploitation requires local access with system execution privileges and does not require user interaction.

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56967 is a high-severity vulnerability in the Cellular Modem component of Google Android. It involves a heap buffer overflow that can cause an out-of-bounds write, potentially allowing remote code execution without user interaction or additional privileges. The vulnerability can be exploited by an adjacent or proximal attacker.

CVE-2026-56964 is a use-after-free vulnerability in multiple locations within Google Android caused by a race condition. It allows local attackers with System execution privileges to escalate their privileges without requiring user interaction. The vulnerability has a medium severity with a CVSS score of 6.4.

In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56958 is an information disclosure vulnerability in the gf_algo_get_cached_dump_data function of the Android operating system. The flaw arises from a missing bounds check that can cause an out-of-bounds read. Exploitation does not require user interaction or elevated privileges. The vulnerability could allow a local attacker to access sensitive information without impacting system integrity or availability.

In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56945 is a high-severity elevation of privilege vulnerability in the VPU component of Google Android. It involves a possible out-of-bounds write caused by a confused deputy issue, allowing local attackers to escalate privileges without requiring additional execution privileges or user interaction.

CVE-2026-56942 is a high-severity elevation of privilege vulnerability in Google Android. It arises from a missing bounds check in the ReadTileInfo function of vp9hwd_headers.cc, leading to a possible out-of-bounds write. Exploitation does not require user interaction or additional execution privileges.

In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56923 is a medium severity elevation of privilege vulnerability in Google Android. It arises from a race condition causing possible memory corruption in the handle_unmap_req function of tipc_virtio_dev.c. Exploitation requires local access but no user interaction or additional execution privileges. No affected versions or patch information is provided.

CVE-2026-56922 is an elevation of privilege vulnerability in Google Android's CPM component. It involves a permission bypass caused by a confused deputy issue, allowing local attackers with system execution privileges to escalate their privileges without user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.7.

CVE-2026-56920 is a high-severity vulnerability in Google Android involving a logic error in the s_decode_vui_param function of fw_hevc_dec_header.c. This flaw can cause an out-of-bounds write, potentially allowing remote code execution without requiring user interaction or additional privileges.

CVE-2026-56915 is a medium severity local elevation of privilege vulnerability in Google Android. It arises from a race condition in the bigo_worker_thread component of bigo.c, allowing an attacker with system execution privileges to escalate their privileges without requiring user interaction.

In multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56892 is an information disclosure vulnerability in the ReadDataElement function of common.c in Google Android. The flaw arises from an incorrect bounds check, potentially allowing local attackers to access sensitive information without requiring additional privileges or user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.2.