CNA 逐项描述（英文证据）：In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge().
Quang Le reported that the AF_UNIX GC could garbage-collect a
receive queue of an alive in-flight socket, with a nice repro.
The repro consists of three stages.
1)
1-a. Create a single cyclic reference with many sockets
1-b. close() all sockets
1-c. Trigger GC
2)
2-a. Pass sk-A to an embryo sk-B
2-b. Pass sk-X to sk-X
2-c. Trigger GC
3)
3-a. accept() the embryo sk-B
3-b. Pass sk-B to sk-C
3-c. close() the in-flight sk-A
3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,
and unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
unix_sk(sk-X)->vertex->scc_index = 3
Once GC completes, unix_graph_grouped is set to true.
Also, unix_graph_maybe_cyclic is set to true due to sk-X's
cyclic self-reference, which makes close() trigger GC.
At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and
links it to unix_unvisited_vertices.
unix_update_graph() is called at 3-a. and 3-b., but neither
unix_graph_grouped nor unix_graph_maybe_cyclic is changed
because both sk-B's listener and sk-C are not in-flight.
3-c decrements sk-A's file refcnt to 1.
Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast()
is finally called and iterates 3 sockets sk-A, sk-B, and sk-X:
sk-A -> sk-B (-> sk-C)
sk-X -> sk-X
This is totally fine. All of them are not yet close()d and
should be grouped into different SCCs.
However, unix_vertex_dead() misjudges that sk-A and sk-B are
in the same SCC and sk-A is dead.
unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong!
&&
sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree
^-- 1 in-flight count for sk-B
-> sk-A is dead !?
The problem is that unix_add_edge() does not initialise scc_index.
Stage 1) is used for heap spraying, making a newly allocated
vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START)
set by unix_walk_scc() at 1-c.
Let's track the max SCC index from the previous unix_walk_scc()
call and assign the max + 1 to a new vertex's scc_index.
This way, we can continue to avoid Tarjan's algorithm while
preventing misjudgments.
CVE-2025-47384 · Qualcomm closed-source components / Closed-source component High
CNA：Qualcomm, Inc. / Snapdragon — 5G Fixed Wireless Access Platform、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、QCA6391、QCA6574A、QCA6595AU、QCA6696、QCA6698AQ、QCM5430、QCM6490、Qualcomm Video Collaboration VC3 Platform、SDX57M、SM7325P、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c+ Gen 3 Compute、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon Auto 5G Modem-RF、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、WCD9341、WCD9360、WCD9370、WCD9375、WCD9380、WCD9385、WCN3988、WSA8810、WSA8815、WSA8830、WSA8835。
CNA：Qualcomm, Inc. / Snapdragon — 5G Fixed Wireless Access Platform、AR8035、CSRA6620、CSRA6640、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、FSM200 Platform、FSM20055、FWA Gen 3 Ultra Platform、G1 Gen 1、Milos、Netrani、Orne、Palawan25、QCA6174A、QCA6391、QCA6574A、QCA6574AU、QCA6584AU、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6698AU、QCA6797AQ、QCA8081、QCA8337、QCC710、QCM2290、QCM4325、QCM4490、QCM5430、QCM6490、QCN6024、QCN6224、QCN6274、QCN9011、QCN9012、QCN9024、QCS2290、QCS4290、QCS4490、QCS8550、QEP8111、QFW7114、QFW7124、QMP1000、Qualcomm Video Collaboration VC3 Platform、Robotics RB2 Platform、SD 8 Gen1 5G、SD662、SDX57M、SDX61、SDX71M、SM6225P、SM6250、SM6650P、SM7325P、SM7435、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM8475P、SM8550P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 460 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 680 4G Mobile Platform、Snapdragon 685 4G Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c Compute Platform、Snapdragon 7c Gen 2 Compute Platform "Rennell Pro"、Snapdragon 7c+ Gen 3 Compute、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon Auto 5G Modem-RF、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon W5+ Gen 1 Wearable Platform、Snapdragon X32 5G Modem-RF System、Snapdragon X35 5G Modem-RF System、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon X70 Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、Snapdragon X80 5G Modem-RF System、SW5100、SW5100P、SW6100、SW6100P、Themisto、WCD9335、WCD9340、WCD9341、WCD9360、WCD9370、WCD9371、WCD9375、WCD9378、WCD9380、WCD9385、WCD9390、WCD9395、WCN3910、WCN3950、WCN3980、WCN3988、WCN6650、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H。
CNA：Qualcomm, Inc. / Snapdragon — AR8035、Cologne、CQ7790、CQ8725S、CQ8750M、FastConnect 6200、FastConnect 6700、FastConnect 6900、FastConnect 7800、Flight RB5 5G Platform、FWA Gen 3 Ultra Platform、G2 Gen 1、G3x Gen 2、Immersive Home 3210 Platform、Immersive Home 326 Platform、IPQ5300、IPQ5302、IPQ5312、IPQ5332、IPQ9008、IPQ9554、IPQ9570、IPQ9574、IQ6 Series Platform、IQ8 Series Platform、IQ9 Series Platform、IQX5121、IQX7181、LeMans_AU_LGIT、LeMansAU、Marina、Milos、Milos_IOT、Molokai、Monaco_IOT、Netrani、Networking Pro 1200 Platform、Networking Pro 1210 Platform、Networking Pro 1610 Platform、Networking Pro 610 Platform、Networking Pro 810 Platform、Orne、Palawan25、Pandeiro、QAM8255P、QAM8295P、QAM8397P、QAMSRV1H、QAMSRV1M、QCA0000、QCA2062、QCA2064、QCA2065、QCA2066、QCA6174A、QCA6391、QCA6554A、QCA6564AU、QCA6574、QCA6574A、QCA6574AU、QCA6584AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8075、QCA8080、QCA8081、QCA8082、QCA8084、QCA8085、QCA8101、QCA8102、QCA8111、QCA8112、QCA8337、QCA8384、QCA8385、QCA8386、QCA8695AU、QCC710、QCF8000、QCF8001、QCM4490、QCM5430、QCM6490、QCN5124、QCN5154、QCN5224、QCN6024、QCN6224、QCN6274、QCN6402、QCN6412、QCN6422、QCN6432、QCN9000、QCN9011、QCN9012、QCN9024、QCN9160、QCN9274、QCS4490、QCS6690、QCS8550、QEP8111、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMB415、QMB715、QMP1000、QMP2001、QPA1083BD、QPA1086BD、QRB5165M、QRB5165N、Qualcomm Video Collaboration VC3 Platform、QXM1083、QXM1086、QXM1093、QXM1094、QXM1095、QXM1096、QXM8083、Robotics RB5 Platform、SA510M、SA6155P、SA7255P、SA7775P、SA8155P、SA8195P、SA8255P、SA8295P、SA8620P、SA8770P、SA9000P、SAR1165P、SAR2130P、SC8380XP、SD 8 Gen1 5G、SDX61、SM6450P、SM6475P、SM6475Q、SM6650P、SM6850、SM7425、SM7435、SM7435P、SM7525、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM8425、SM8475P、SM8550P、SM8635、SM8635P、SM8650Q、SM8735P、SM8750P、SM8845P、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7 Gen 4 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon 8cx Gen 3 Compute Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon AR1+ Gen 1 Platform、Snapdragon Auto 5G Modem-RF、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon X32 5G Modem-RF System、Snapdragon X35 5G Modem-RF System、Snapdragon X62 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、SRV1H、SRV1M、SW-only、SXR2230P、SXR2250P、SXR2330P、SXR2350P、WCD9340、WCD9370、WCD9371、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3950、WCN3988、WCN6450、WCN6650、WCN6755、WCN7760、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、WSA8850、WSA8850W、WSA8855C、X1E80100、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039、XRV7209、XRV9209。
CNA：Qualcomm, Inc. / Snapdragon — AR8035、Cologne、CQ7790、CQ8725S、CQ8750M、CSR8811、FastConnect 6200、FastConnect 6700、FastConnect 6900、FastConnect 7800、FWA Gen 3 Ultra Platform、FWA Gen 5 Elite Platform、G2 Gen 1、G3x Gen 2、Immersive Home 214 Platform、Immersive Home 216 Platform、Immersive Home 316 Platform、Immersive Home 318 Platform、Immersive Home 3210 Platform、Immersive Home 326 Platform、IPQ5010、IPQ5028、IPQ5300、IPQ5302、IPQ5312、IPQ5332、IPQ6000、IPQ6010、IPQ6018、IPQ8076、IPQ8078、IPQ9008、IPQ9554、IPQ9570、IPQ9574、IQX5121、IQX7181、Kobuk、LeMans_AU_LGIT、LeMansAU、Marina、Milos、Milos_IOT、Molokai、Netrani、Networking Pro 1200 Platform、Networking Pro 1210 Platform、Networking Pro 1610 Platform、Networking Pro 400 Platform、Networking Pro 600 Platform、Networking Pro 610 Platform、Networking Pro 800 Platform、Networking Pro 810 Platform、NPro A8 Elite Platform、Orne、Palawan25、Pandeiro、QAM8255P、QAM8397P、QAMSRV1H、QAMSRV1M、QCA0000、QCA4024、QCA6174A、QCA6391、QCA6554A、QCA6564AU、QCA6574、QCA6574A、QCA6574AU、QCA6584AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8072、QCA8075、QCA8080、QCA8081、QCA8082、QCA8084、QCA8085、QCA8337、QCA8386、QCA8695AU、QCA9888、QCA9889、QCC2073、QCC2076、QCC710、QCF8000、QCF8001、QCM4490、QCM5430、QCM6490、QCN5022、QCN5024、QCN5052、QCN5054、QCN5122、QCN5124、QCN5152、QCN5154、QCN5164、QCN6023、QCN6024、QCN6122、QCN6132、QCN6224、QCN6274、QCN6402、QCN6412、QCN6422、QCN6432、QCN9000、QCN9001、QCN9002、QCN9003、QCN9011、QCN9012、QCN9022、QCN9024、QCN9070、QCN9100、QCN9274、QCS4490、QCS6690、QCS8550、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMB415、QMB715、QMP1000、QMP2001、QPA1083BD、QPA1086BD、Qualcomm Video Collaboration VC3 Platform、QXM1083、QXM1086、QXM1093、QXM1094、QXM1095、QXM1096、SA7255P、SA7775P、SA8255P、SA8620P、SA8770P、SA9000P、SAR1165P、SAR2130P、SC8380XP、SD 8 Gen1 5G、SDX61、SDX65M、SDX81、SM6450P、SM6475P、SM6475Q、SM6650P、SM6850、SM7425、SM7435、SM7435P、SM7525、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM8425、SM8475P、SM8550P、SM8635、SM8635P、SM8650Q、SM8735P、SM8750P、SM8845P、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7 Gen 4 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon AR1+ Gen 1 Platform、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon X62 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、SRV1H、SRV1M、SXR2230P、SXR2250P、SXR2330P、SXR2350P、Trestles、WCD9340、WCD9370、WCD9371、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3950、WCN3988、WCN6450、WCN6650、WCN6755、WCN7760、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、WSA8850、WSA8850W、WSA8855C、X1E80100、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039、XRV7209、XRV9209。
CNA 逐项描述（英文证据）：In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-59604 · Qualcomm closed-source components / Closed-source component High
CNA：Qualcomm, Inc. / Snapdragon — AR8035、Cologne、CSRA6620、CSRA6640、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、FWA Gen 3 Ultra Platform、G1 Gen 1、G2 Gen 1、IQ6 Series Platform、IQ8 Series Platform、IQ9 Series Platform、LeMans_AU_LGIT、LeMansAU、Milos、Monaco_IOT、Netrani、Orne、Palawan25、Pandeiro、QAM8255P、QAM8295P、QAM8620P、QAMSRV1H、QAMSRV1M、QCA0000、QCA6174A、QCA6391、QCA6574、QCA6574A、QCA6574AU、QCA6584AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6698AU、QCA6797AQ、QCA8081、QCA8337、QCA8695AU、QCC710、QCM2290、QCM4325、QCM4490、QCM5430、QCM6125、QCM6490、QCN6024、QCN6224、QCN6274、QCN9011、QCN9012、QCN9024、QCS2290、QCS4290、QCS4490、QCS8550、QDX1010、QDX1011、QEP8111、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMP1000、QPA1083BD、QPA1086BD、QRU1032、Qualcomm Dragonwing QRU100 Platform、Qualcomm Dragonwing X100 Accelerator Card、Qualcomm Video Collaboration VC1 Platform、Qualcomm Video Collaboration VC3 Platform、QXM1093、QXM1094、QXM1095、QXM1096、Robotics RB2 Platform、SA4150P、SA4155P、SA6145P、SA6150P、SA6155P、SA7255P、SA7775P、SA8145P、SA8150P、SA8155P、SA8195P、SA8255P、SA8295P、SA8540P、SA8620P、SA8770P、SA9000P、SAR1250P、SAR2130P、SAR2230P、SC8380XP、SD 8 Gen1 5G、SD662、SD865 5G、SDX61、SM6225P、SM6650P、SM7250P、SM7325P、SM7435、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM8475P、SM8550P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 460 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 680 4G Mobile Platform、Snapdragon 685 4G Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 720G Mobile Platform、Snapdragon 765 5G Mobile Platform、Snapdragon 765G 5G Mobile Platform、Snapdragon 768G 5G Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c+ Gen 3 Compute、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon 8cx Gen 3 Compute Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon W5+ Gen 1 Wearable Platform、Snapdragon X32 5G Modem-RF System、Snapdragon X35 5G Modem-RF System、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、Snapdragon XR2 5G Platform、Snapdragon XR2+ Gen 1 Platform、SRV1H、SRV1L、SRV1M、SW5100、SW5100P、SXR2230P、SXR2250P、SXR2330P、SXR2350P、WCD9335、WCD9340、WCD9370、WCD9371、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3910、WCN3950、WCN3980、WCN3988、WCN6650、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039。
CNA：Qualcomm, Inc. / Snapdragon — AR8035、CSRA6620、CSRA6640、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、Flight RB5 5G Platform、G1 Gen 1、QAM8255P、QAM8295P、QCA6174A、QCA6391、QCA6574、QCA6574A、QCA6574AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6698AU、QCA6797AQ、QCA8081、QCA8337、QCM2290、QCM4325、QCM4490、QCM5430、QCM6125、QCM6490、QCN6024、QCN9011、QCN9012、QCN9024、QCS2290、QCS4290、QCS4490、QCS8550、QDX1010、QDX1011、QRB5165M、QRB5165N、QRU1032、Qualcomm Dragonwing QRU100 Platform、Qualcomm Dragonwing X100 Accelerator Card、Qualcomm Video Collaboration VC1 Platform、Qualcomm Video Collaboration VC3 Platform、Qualcomm Video Collaboration VC5 Platform、Robotics RB2 Platform、Robotics RB5 Platform、SA4150P、SA4155P、SA6145P、SA6150P、SA6155P、SA8145P、SA8150P、SA8155P、SA8195P、SA8255P、SA8295P、SA8540P、SA9000P、SAR2130P、SD 8 Gen1 5G、SD662、SD865 5G、SDX61、SM6225P、SM7250P、SM7325P、SM7435、SM7550、SM7550P、SM8475P、SM8550P、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 460 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 680 4G Mobile Platform、Snapdragon 685 4G Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 720G Mobile Platform、Snapdragon 765 5G Mobile Platform、Snapdragon 765G 5G Mobile Platform、Snapdragon 768G 5G Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c+ Gen 3 Compute、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon W5+ Gen 1 Wearable Platform、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon XR2 5G Platform、Snapdragon XR2+ Gen 1 Platform、SW5100、SW5100P、SXR2230P、SXR2250P、WCD9335、WCD9370、WCD9371、WCD9375、WCD9378、WCD9380、WCD9385、WCD9390、WCD9395、WCN3910、WCN3950、WCN3980、WCN3988、WCN6650、WCN6755、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H。
CNA：Qualcomm, Inc. / Snapdragon — Cologne、FastConnect 6200、FastConnect 6700、FastConnect 6900、FastConnect 7800、G2 Gen 1、IQ6 Series Platform、IQ8 Series Platform、IQ9 Series Platform、LeMans_AU_LGIT、LeMansAU、Monaco_IOT、Netrani、Orne、Palawan25、Pandeiro、QAM8255P、QAM8295P、QAM8620P、QAMSRV1H、QAMSRV1M、QCA6574、QCA6574A、QCA6574AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6797AQ、QCA8695AU、QCM5430、QCM6490、QLN1083BD、QLN1086BD、QMP1000、QPA1083BD、QPA1086BD、Qualcomm Video Collaboration VC3 Platform、QXM1093、QXM1094、QXM1095、QXM1096、SA6145P、SA6150P、SA6155P、SA7255P、SA7775P、SA8145P、SA8150P、SA8155P、SA8195P、SA8255P、SA8295P、SA8540P、SA8620P、SA8770P、SA9000P、SAR1250P、SAR2230P、SM7435、SM8750P、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 8 Elite、SRV1H、SRV1L、SRV1M、SXR2330P、SXR2350P、WCD9370、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9395、WCN3950、WCN3988、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039。
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号；CNA：Qualcomm, Inc. / Snapdragon — AR8035、CSR8811、CSRA6620、CSRA6640、FastConnect 6700、FastConnect 6900、FastConnect 7800、Flight RB5 5G Platform、FWA Gen 3 Ultra Platform、Immersive Home 214 Platform、Immersive Home 216 Platform、Immersive Home 316 Platform、Immersive Home 318 Platform、Immersive Home 3210 Platform、Immersive Home 326 Platform、IPQ5010、IPQ5028、IPQ5300、IPQ5302、IPQ5312、IPQ5332、IPQ6000、IPQ6010、IPQ6018、IPQ8076、IPQ8078、IPQ9008、IPQ9554、IPQ9570、IPQ9574、IQ6 Series Platform、IQ8 Series Platform、IQ9 Series Platform、LeMans_AU_LGIT、LeMansAU、Marina、Milos、Monaco_IOT、Networking Pro 1200 Platform、Networking Pro 1210 Platform、Networking Pro 1610 Platform、Networking Pro 400 Platform、Networking Pro 600 Platform、Networking Pro 610 Platform、Networking Pro 800 Platform、Networking Pro 810 Platform、Pandeiro、QAM8255P、QAM8295P、QAMSRV1H、QAMSRV1M、QCA0000、QCA4024、QCA6391、QCA6554A、QCA6564AU、QCA6574、QCA6574A、QCA6574AU、QCA6584AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8075、QCA8080、QCA8081、QCA8082、QCA8084、QCA8085、QCA8101、QCA8102、QCA8111、QCA8112、QCA8337、QCA8384、QCA8385、QCA8386、QCA9888、QCA9889、QCC710、QCF8000、QCF8001、QCM5430、QCM6490、QCN5022、QCN5024、QCN5052、QCN5122、QCN5124、QCN5152、QCN5154、QCN5164、QCN5224、QCN6023、QCN6024、QCN6122、QCN6132、QCN6224、QCN6274、QCN6402、QCN6412、QCN6422、QCN6432、QCN9000、QCN9022、QCN9024、QCN9070、QCN9100、QCN9160、QCN9274、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QPA1083BD、QPA1086BD、QRB5165N、Qualcomm Video Collaboration VC3 Platform、Qualcomm Video Collaboration VC5 Platform、QXM1093、QXM1094、QXM1095、QXM1096、QXM8083、Robotics RB2 Platform、Robotics RB5 Platform、SA6155P、SA7255P、SA7775P、SA8155P、SA8195P、SA8255P、SA8295P、SA8620P、SA8770P、SA9000P、SAR1250P、SAR2130P、SAR2230P、SM6650P、SM7550、SM7550P、SM7635P、SM7675、SM8550P、SM8635、SM8650Q、Snapdragon 460 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon X75 5G Modem-RF System、SRV1H、SRV1M、SW-only、SW5100P、SXR2230P、SXR2250P、WCD9335、WCD9340、WCD9370、WCD9371、WCD9375、WCD9378、WCD9380、WCD9385、WCD9390、WCD9395、WCN3950、WCN3988、WCN6650、WCN6755、WCN7860、WCN7861、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H。
CNA 逐项描述（英文证据）：LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.
CNA 逐项描述（英文证据）：LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component ≤ alpha × 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.
CNA 逐项描述（英文证据）：LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.
CNA 逐项描述（英文证据）：In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CNA 逐项描述（英文证据）：In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CNA 逐项描述（英文证据）：In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CNA 逐项描述（英文证据）：In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CNA 逐项描述（英文证据）：In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CNA 逐项描述（英文证据）：In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due to an unusual root cause. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
触发位置：getCallingAppLabel of CertInstaller.java；攻击位置：本地；所需执行权限：无需额外执行权限；用户交互：不需要。
安全影响
权限提升（EoP）
漏洞成因分析
已披露位置：getCallingAppLabel of CertInstaller.java。CNA 缺陷分类：Elevation of privilege。CNA 披露的原因是：misleading or insufficient UI。该描述尚不足以定位具体错误代码或完整失效路径，不能仅凭组件或等级补写未经验证的细节。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
触发位置：getAppLabel of ForgetDeviceDialogFragment.java；攻击位置：本地；所需执行权限：无需额外执行权限；用户交互：不需要。
安全影响
权限提升（EoP）
漏洞成因分析
已披露位置：getAppLabel of ForgetDeviceDialogFragment.java。CNA 缺陷分类：Elevation of privilege。CNA 披露的原因是：misleading or insufficient UI。该描述尚不足以定位具体错误代码或完整失效路径，不能仅凭组件或等级补写未经验证的细节。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0125 · Kernel components / Video Processing Unit High
CNA 逐项描述（英文证据）：In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0148 · Pixel / IP Multimedia Subsystem High
CNA 逐项描述（英文证据）：In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with root privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0161 · Pixel / Real-time Transport Protocol Critical
CNA 逐项描述（英文证据）：In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0162 · Pixel / IP Multimedia Subsystem Critical
CNA 逐项描述（英文证据）：In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-20431 · MediaTek components / Modem High
CVE
CVE-2026-20431
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6813、MT6815、MT6835、MT6878、MT6897、MT6899、MT6986、MT6991、MT6993、MT8668、MT8676、MT8678、MT8755、MT8775、MT8792、MT8793、MT8863、MT8873、MT8883。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
安全影响
拒绝服务或崩溃（CNA 描述；Google 表格未另列 Type）
漏洞成因分析
已披露位置：Modem。CNA 缺陷分类：CWE-770 Allocation of Resources Without Limits or Throttling。CNA 指出逻辑错误；机制分析：业务状态或检查顺序不满足原设计约束；公开描述不足以据此断言某一种内存缺陷。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01106496; Issue ID: MSV-4467.
CVE-2026-20432 · MediaTek components / Modem High
CVE
CVE-2026-20432
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT2737、MT6779、MT6781、MT6783、MT6785、MT6789、MT6813、MT6815、MT6833、MT6835、MT6853、MT6855、MT6873、MT6875、MT6877、MT6878、MT6879、MT6880、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6896、MT6897、MT6899、MT6980、MT6983、MT6985、MT6989、MT6990、MT6991、MT6993、MT8668、MT8673、MT8675、MT8676、MT8678、MT8755、MT8771、MT8775、MT8781、MT8789、MT8791、MT8791T、MT8792、MT8793、MT8795T、MT8797、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：需要；CNA 其他条件（原文）：This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01406170; Issue ID: MSV-4461.
CVE-2026-20433 · MediaTek components / Modem High
CVE
CVE-2026-20433
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT2737、MT6813、MT6833、MT6833P、MT6835、MT6835T、MT6853、MT6853T、MT6855、MT6855T、MT6873、MT6875、MT6875T、MT6877、MT6877T、MT6877TT、MT6878、MT6878M、MT6879、MT6880、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6895TT、MT6896、MT6897、MT6899、MT6980、MT6980D、MT6983、MT6983T、MT6985、MT6985T、MT6989、MT6989T、MT6990、MT6991、MT8668、MT8673、MT8675、MT8676、MT8678、MT8755、MT8771、MT8775、MT8791、MT8791T、MT8792、MT8793、MT8795T、MT8797、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：需要；CNA 其他条件（原文）：This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01088681; Issue ID: MSV-4460.
CVE-2026-20435 · MediaTek components / preloader High
CVE
CVE-2026-20435
组件
MediaTek components / preloader
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2737、MT6739、MT6761、MT6765、MT6768、MT6781、MT6789、MT6813、MT6833、MT6853、MT6855、MT6877、MT6878、MT6879、MT6880、MT6885、MT6886、MT6890、MT6893、MT6895、MT6897、MT6983、MT6985、MT6989、MT6990、MT6993、MT8169、MT8186、MT8188、MT8370、MT8390、MT8676、MT8678、MT8696、MT8793。
攻击入口与前提
触发位置：preloader；入口：需物理接触或近距离条件；攻击位置：本地；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.
CVE-2026-20447 · MediaTek components / geniezone High
CVE
CVE-2026-20447
组件
MediaTek components / geniezone
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6768、MT6789、MT6877、MT6899、MT6989、MT6991、MT6993、MT8196、MT8367、MT8766、MT8768、MT8781、MT8786、MT8788E、MT8791T、MT8793、MT8910。
攻击入口与前提
触发位置：geniezone；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10724073; Issue ID: MSV-6296.
CVE-2026-20448 · MediaTek components / geniezone High
CVE
CVE-2026-20448
组件
MediaTek components / geniezone
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6765、MT6768、MT6789、MT6877、MT6897、MT6899、MT6989、MT6991、MT6993、MT8367、MT8766、MT8768、MT8775、MT8781、MT8786、MT8788E、MT8791T、MT8792、MT8793、MT8796、MT8893、MT8910。
攻击入口与前提
触发位置：geniezone；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
安全影响
权限提升（CNA 描述；Google 表格未另列 Type）
漏洞成因分析
已披露位置：geniezone。CNA 缺陷分类：CWE-280 Improper Handling of Insufficient Permissions or Privileges。CNA 指出权限校验缺失或绕过；机制分析：敏感操作没有可靠地把调用者身份、权限与目标资源关联起来，原有权限边界可能被越过。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10708513; Issue ID: MSV-6281.
CVE-2026-20449 · MediaTek components / Modem High
CVE
CVE-2026-20449
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT2737、MT6739、MT6761、MT6762、MT6763、MT6765、MT6767、MT6768、MT6769、MT6771、MT6779、MT6781、MT6783、MT6785、MT6789、MT6813、MT6815、MT6833、MT6835、MT6853、MT6855、MT6858、MT6873、MT6875、MT6877、MT6878、MT6879、MT6880、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6896、MT6897、MT6899、MT6980、MT6983、MT6985、MT6986D、MT6988、MT6989、MT6990、MT6991、MT6993、MT8668、MT8673、MT8675、MT8676、MT8678、MT8755、MT8771、MT8775、MT8791、MT8791T、MT8792、MT8793、MT8795T、MT8797、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01760138; Issue ID: MSV-6148.
CVE-2026-20450 · MediaTek components / Modem High
CVE
CVE-2026-20450
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT2737、MT6833、MT6835、MT6853、MT6855、MT6858、MT6873、MT6875、MT6877、MT6878、MT6879、MT6880、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6896、MT6897、MT6899、MT6980、MT6983、MT6985、MT6986、MT6989、MT6990、MT6991、MT6993、MT8668、MT8673、MT8675、MT8676、MT8678、MT8755、MT8771、MT8775、MT8791、MT8791T、MT8792、MT8793、MT8795T、MT8797、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01753620; Issue ID: MSV-6100.
CVE-2026-20453 · MediaTek components / geniezone High
CVE
CVE-2026-20453
组件
MediaTek components / geniezone
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6739、MT6761、MT6765、MT6768、MT6781、MT6789、MT6835、MT6853、MT6855、MT6877、MT6878、MT6879、MT6883、MT6885、MT6886、MT6889、MT6893、MT6895、MT6897、MT6899、MT6983、MT6985、MT6989、MT6991、MT8673、MT8765、MT8766、MT8768、MT8781、MT8786、MT8788、MT8791T、MT8793、MT8797、MT8798、MT8910。
攻击入口与前提
触发位置：geniezone；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10886526; Issue ID: MSV-6791.
CVE-2026-20454 · MediaTek components / geniezone High
CVE
CVE-2026-20454
组件
MediaTek components / geniezone
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6739、MT6761、MT6765、MT6768、MT6781、MT6789、MT6835、MT6853、MT6855、MT6877、MT6878、MT6879、MT6883、MT6885、MT6886、MT6889、MT6893、MT6895、MT6897、MT6899、MT6983、MT6985、MT6989、MT6991、MT8673、MT8765、MT8766、MT8768、MT8781、MT8786、MT8788、MT8791T、MT8793、MT8797、MT8798、MT8910。
攻击入口与前提
触发位置：geniezone；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786.
CVE-2026-20455 · MediaTek components / geniezone High
CVE
CVE-2026-20455
组件
MediaTek components / geniezone
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6739、MT6761、MT6765、MT6768、MT6781、MT6789、MT6835、MT6853、MT6855、MT6877、MT6878、MT6879、MT6883、MT6885、MT6886、MT6889、MT6893、MT6895、MT6897、MT6899、MT6983、MT6985、MT6989、MT6991、MT8673、MT8765、MT8766、MT8768、MT8781、MT8786、MT8788、MT8791T、MT8793、MT8797、MT8798、MT8910。
攻击入口与前提
触发位置：geniezone；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6784.
具体攻击入口未在公告中细分；参照下方 CNA 逐项描述；所需权限：公告/CNA 未明确；用户交互：公告/CNA 未明确；CNA CVSS 向量：CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H；CNA 其他条件（原文）：Exploitation of this issue requires user interaction in that a victim must open a malicious file.。
CNA 逐项描述（英文证据）：DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
具体攻击入口未在公告中细分；参照下方 CNA 逐项描述；所需权限：公告/CNA 未明确；用户交互：公告/CNA 未明确；CNA CVSS 向量：CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H；CNA 其他条件（原文）：Exploitation of this issue requires user interaction in that a victim must open a malicious file.。
CNA 逐项描述（英文证据）：DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-21367 · Qualcomm closed-source components / Closed-source component High
CNA：Qualcomm, Inc. / Snapdragon — AR8035、Cologne、CSR8811、FastConnect 6200、FastConnect 6700、FastConnect 6900、FastConnect 7800、FWA Gen 3 Ultra Platform、G2 Gen 1、Immersive Home 214 Platform、Immersive Home 216 Platform、Immersive Home 316 Platform、Immersive Home 318 Platform、IPQ5010、IPQ5028、IPQ6000、IPQ6010、IPQ6018、IPQ8076、IPQ8078、IPQ9574、Milos、Netrani、Networking Pro 1200 Platform、Networking Pro 1210 Platform、Networking Pro 1610 Platform、Networking Pro 400 Platform、Networking Pro 600 Platform、Networking Pro 610 Platform、Networking Pro 800 Platform、Networking Pro 810 Platform、Orne、Palawan25、Pandeiro、QCA4024、QCA6391、QCA6698AU、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8075、QCA8081、QCA8082、QCA8084、QCA8085、QCA8337、QCA8386、QCA9888、QCA9889、QCC2073、QCC2076、QCC710、QCM4490、QCN5022、QCN5024、QCN5052、QCN5122、QCN5124、QCN5152、QCN5154、QCN5164、QCN6023、QCN6024、QCN6122、QCN6132、QCN6224、QCN6274、QCN9000、QCN9011、QCN9012、QCN9022、QCN9024、QCN9070、QCN9100、QCN9274、QCS4490、QCS8550、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMP1000、QPA1083BD、QPA1086BD、QXM1093、QXM1094、QXM1095、QXM1096、SAR2130P、SC8380XP、SD 8 Gen1 5G、SM6650P、SM7435、SM7635P、SM7675、SM7675P、SM8475P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、WCD9340、WCD9370、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3950、WCN3988、WCN6450、WCN6650、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039、XRV7209、XRV9209。
CNA：Qualcomm, Inc. / Snapdragon — Cologne、FastConnect 6700、FastConnect 6900、FastConnect 7800、QCM5430、QCM6490、Qualcomm Video Collaboration VC3 Platform、Snapdragon 460 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 7c+ Gen 3 Compute、WCD9370、WCD9375、WCD9378C、WCD9380、WCD9385、WCN3950、WCN3988、WSA8840、WSA8845、WSA8845H、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039。
CNA：Qualcomm, Inc. / Snapdragon — Cologne、FastConnect 6700、FastConnect 6900、FastConnect 7800、QCA0000、QCM5430、QCM6490、Qualcomm Video Collaboration VC3 Platform、SC8380XP、Snapdragon 460 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 7c+ Gen 3 Compute、Snapdragon 8cx Gen 3 Compute Platform、Snapdragon AR1 Gen 1 Platform、WCD9370、WCD9375、WCD9378C、WCD9380、WCD9385、WCN3950、WCN3988、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039。
CNA：Qualcomm, Inc. / Snapdragon — AR8035、Cologne、FastConnect 6200、FastConnect 6700、FastConnect 6900、FastConnect 7800、FWA Gen 3 Ultra Platform、G2 Gen 1、Milos、Netrani、Orne、Palawan25、Pandeiro、QCA6391、QCA6698AU、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8081、QCA8337、QCC2073、QCC2076、QCC710、QCN6224、QCN6274、QCN9011、QCN9012、QCS8550、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMP1000、QPA1083BD、QPA1086BD、QXM1083、QXM1086、QXM1093、QXM1094、QXM1095、QXM1096、SAR1165P、SAR2130P、SC8380XP、SM6650P、SM7435、SM7635P、SM7675、SM7675P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon AR1+ Gen 1 Platform、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、SXR2230P、SXR2250P、SXR2330P、SXR2350P、WCD9340、WCD9370、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3988、WCN6450、WCN6650、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039、XRV7209、XRV9209。
CNA 逐项描述（英文证据）：Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
CVE-2026-21538 · Unisoc components / Modem High
CVE
CVE-2026-21538
组件
Unisoc components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
公告仅列出组件，未公开精确设备、芯片或版本范围；需向设备厂商确认。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
公告未细分漏洞类型；具体安全后果以 CNA 逐项描述为准
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory.
This is caused by improper handling of the memory protections for the user-mode wrapped memory resource.
CVE-2026-22163 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Requires malware code to misuse the DDK kernel module IOCTL interface.
Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages.
The product utilises a shared resource in a concurrent manner but does not attempt to synchronise access to the resource.
CVE-2026-22167 · Imagination Technologies / PowerVR-GPU High
CNA 缺陷分类：CWE - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (4.18)。公开 CNA 描述未提供足以可靠细分根因的机制；目前只能确认下方逐项描述中的问题，不能仅凭组件或等级推断具体代码缺陷。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages.
Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.
This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号；CNA：Qualcomm, Inc. / Snapdragon — AQT1000、AR8035、CSRA6620、CSRA6640、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、Flight RB5 5G Platform、FWA Gen 3 Ultra Platform、G1 Gen 1、G2 Gen 1、Milos、Netrani、Orne、Palawan25、QCA6391、QCA6420、QCA6430、QCA6574、QCA6574A、QCA6574AU、QCA6595AU、QCA6696、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8081、QCA8337、QCC710、QCM2290、QCM4325、QCM4490、QCM5430、QCM6490、QCN6224、QCN6274、QCN9011、QCN9012、QCS2290、QCS4290、QCS4490、QFW7114、QFW7124、QMP1000、QRB5165M、QRB5165N、Qualcomm Video Collaboration VC3 Platform、Qualcomm Video Collaboration VC5 Platform、Robotics RB2 Platform、Robotics RB5 Platform、SA6155P、SA8155、SA8155P、SA8195P、SD 8 Gen1 5G、SD662、SD865 5G、SM6225P、SM6650P、SM7325P、SM7435、SM7635P、SM7675、SM7675P、SM8475P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 460 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 680 4G Mobile Platform、Snapdragon 685 4G Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c+ Gen 3 Compute、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon 8c Compute Platform "Poipu Lite"、Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite"、Snapdragon 8cx Compute Platform、Snapdragon 8cx Compute Platform "Poipu Pro"、Snapdragon 8cx Gen 2 5G Compute Platform、Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro"、Snapdragon 8cx Gen 3 Compute Platform、Snapdragon W5+ Gen 1 Wearable Platform、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、Snapdragon XR2 5G Platform、Snapdragon XR2+ Gen 1 Platform、SW5100、SW5100P、WCD9335、WCD9340、WCD9341、WCD9370、WCD9375、WCD9378、WCD9380、WCD9385、WCD9390、WCD9395、WCN3910、WCN3950、WCN3980、WCN3988、WCN6650、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H。
CNA：Qualcomm, Inc. / Snapdragon — Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5。
CNA：Qualcomm, Inc. / Snapdragon — Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5。
CNA 逐项描述（英文证据）：In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.