CNA 逐项描述（英文证据）：In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-48651 · Tsingteng Micro / StrongBox High
CVE
CVE-2025-48651
组件
Tsingteng Micro / StrongBox
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：Google / Android — Android SoC。
攻击入口与前提
触发位置：importWrappedKey of KMKeymasterApplet.java；攻击位置：本地；所需执行权限：无需额外执行权限；用户交互：不需要。
安全影响
信息泄露（CNA 描述；Google 表格未另列 Type）
漏洞成因分析
已披露位置：importWrappedKey of KMKeymasterApplet.java。CNA 指出输入验证不充分；机制分析：外部输入在进入敏感操作前未满足预期约束；具体失效约束需结合该条描述及代码确认。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.
CNA 逐项描述（英文证据）：In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0199 · Pixel / Goodix Fingerprint TA Critical
CNA 逐项描述（英文证据）：In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.
CNA 逐项描述（英文证据）：Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.
CVE-2026-20457 · MediaTek components / Modem High
CVE
CVE-2026-20457
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT2737、MT6739、MT6761、MT6762、MT6763、MT6765、MT6767、MT6768、MT6769、MT6771、MT6779、MT6781、MT6783、MT6785、MT6789、MT6833、MT6853、MT6855、MT6873、MT6875、MT6877、MT6879、MT6880、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6896、MT6980、MT6983、MT6985、MT6989、MT6990、MT8666、MT8667、MT8673、MT8675、MT8765、MT8766、MT8766R、MT8768、MT8771、MT8781、MT8786、MT8788、MT8788E、MT8789、MT8791、MT8791T、MT8795T、MT8796、MT8797、MT8798、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01826924; Issue ID: MSV-7301.
CVE-2026-20458 · MediaTek components / Modem High
CVE
CVE-2026-20458
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2716、MT2737、MT6739、MT6761、MT6762、MT6763、MT6765、MT6767、MT6768、MT6769、MT6771、MT6779、MT6781、MT6783、MT6785、MT6789、MT6813、MT6835、MT6858、MT6878、MT6879、MT6881、MT6886、MT6895、MT6896、MT6897、MT6899、MT6980、MT6982、MT6983、MT6985、MT6986、MT6986D、MT6988、MT6989、MT6990、MT6991、MT6993、MT8666、MT8667、MT8668、MT8673、MT8676、MT8678、MT8755、MT8765、MT8766、MT8766R、MT8768、MT8775、MT8781、MT8786、MT8788、MT8788E、MT8789、MT8792、MT8793、MT8795T、MT8796、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01402160; Issue ID: MSV-7298.
CVE-2026-20459 · MediaTek components / Modem High
CVE
CVE-2026-20459
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2716、MT2735、MT2737、MT6739、MT6761、MT6762、MT6763、MT6765、MT6767、MT6768、MT6769、MT6771、MT6779、MT6781、MT6783、MT6785、MT6789、MT6813、MT6833、MT6835、MT6853、MT6855、MT6858、MT6873、MT6875、MT6877、MT6878、MT6879、MT6880、MT6881、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6896、MT6897、MT6899、MT6980、MT6982、MT6983、MT6985、MT6986、MT6986D、MT6988、MT6989、MT6990、MT6991、MT6993、MT8666、MT8667、MT8668、MT8673、MT8675、MT8676、MT8678、MT8755、MT8765、MT8766、MT8766R、MT8768、MT8771、MT8775、MT8781、MT8786、MT8788、MT8788E、MT8789、MT8791、MT8791T、MT8792、MT8793、MT8795T、MT8796、MT8797、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
安全影响
拒绝服务或崩溃（CNA 描述；Google 表格未另列 Type）
漏洞成因分析
已披露位置：Modem。CNA 缺陷分类：CWE-288 Authentication Bypass Using an Alternate Path or Channel。CNA 指出输入验证不充分；机制分析：外部输入在进入敏感操作前未满足预期约束；具体失效约束需结合该条描述及代码确认。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842.
CVE-2026-20460 · MediaTek components / Modem High
CVE
CVE-2026-20460
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT2737、MT6779、MT6781、MT6783、MT6785、MT6789、MT6813、MT6833、MT6835、MT6853、MT6855、MT6858、MT6873、MT6875、MT6877、MT6878、MT6879、MT6880、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6896、MT6897、MT6899、MT6980、MT6983、MT6985、MT6986D、MT6988、MT6989、MT6990、MT6991、MT6993、MT8673、MT8675、MT8676、MT8678、MT8755、MT8765、MT8766、MT8766R、MT8768、MT8771、MT8775、MT8781、MT8786、MT8788、MT8788E、MT8789、MT8791、MT8791T、MT8792、MT8793、MT8795T、MT8796、MT8797、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
安全影响
信息泄露（CNA 描述；Google 表格未另列 Type）
漏洞成因分析
已披露位置：Modem。CNA 缺陷分类：CWE-288 Authentication Bypass Using an Alternate Path or Channel。CNA 指出输入验证不充分；机制分析：外部输入在进入敏感操作前未满足预期约束；具体失效约束需结合该条描述及代码确认。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788.
CVE-2026-20461 · MediaTek components / Modem High
CVE
CVE-2026-20461
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2737、MT6813、MT6835、MT6858、MT6878、MT6879、MT6886、MT6895、MT6896、MT6897、MT6899、MT6980、MT6983、MT6985、MT6988、MT6989、MT6990、MT6991、MT6993、MT8673、MT8676、MT8678、MT8755、MT8775、MT8792、MT8793、MT8795T、MT8796、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01267281 / MOLY01318201; Issue ID: MSV-6486.
CVE-2026-20464 · MediaTek components / hevc decoder High
CVE
CVE-2026-20464
组件
MediaTek components / hevc decoder
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6761、MT8766、MT8768。
攻击入口与前提
触发位置：hevc decoder；攻击位置：远程（具体传输通道以逐项描述为准）；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297.
CVE-2026-20467 · MediaTek components / apusys High
CVE
CVE-2026-20467
组件
MediaTek components / apusys
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT8195、MT8196、MT8366。
攻击入口与前提
触发位置：apusys；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767.
CVE-2026-20468 · MediaTek components / apusys High
CVE
CVE-2026-20468
组件
MediaTek components / apusys
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT8196、MT8366。
攻击入口与前提
触发位置：apusys；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741.
CVE-2026-20469 · MediaTek components / trusted_mem High
CVE
CVE-2026-20469
组件
MediaTek components / trusted_mem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT8186、MT8188、MT8195、MT8365、MT8370、MT8371、MT8390、MT8391、MT8395。
攻击入口与前提
触发位置：trusted_mem；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In trusted_mem, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: AUTO00834868; Issue ID: MSV-6533.
CVE-2026-20473 · MediaTek components / display High
CVE
CVE-2026-20473
组件
MediaTek components / display
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6991、MT6993、MT8126、MT8171、MT8188、MT8189、MT8367、MT8668、MT8676、MT8678、MT8766、MT8768、MT8781、MT8786、MT8791T、MT8799、MT8910。
攻击入口与前提
触发位置：display；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
已披露位置：display。CNA 缺陷分类：CWE-416 Use After Free。CNA 指出释放后使用（UAF）；机制分析：对象释放与后续访问的生命周期约束失效，旧引用仍可能被解引用。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019722; Issue ID: MSV-7759.
CVE-2026-20474 · MediaTek components / display High
CVE
CVE-2026-20474
组件
MediaTek components / display
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6991、MT6993、MT8126、MT8171、MT8188、MT8189、MT8367、MT8668、MT8676、MT8678、MT8766、MT8768、MT8781、MT8786、MT8791T、MT8799、MT8910。
攻击入口与前提
触发位置：display；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.
CVE-2026-20475 · MediaTek components / display High
CVE
CVE-2026-20475
组件
MediaTek components / display
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6991、MT6993、MT8126、MT8171、MT8188、MT8189、MT8367、MT8668、MT8676、MT8678、MT8766、MT8768、MT8781、MT8786、MT8791T、MT8799、MT8910。
攻击入口与前提
触发位置：display；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7748.
CVE-2026-20477 · MediaTek components / display High
CVE
CVE-2026-20477
组件
MediaTek components / display
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6991、MT6993、MT8188、MT8189、MT8668、MT8676、MT8678、MT8781、MT8799、MT8910。
攻击入口与前提
触发位置：display；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11009963; Issue ID: MSV-7658.
CVE-2026-20479 · MediaTek components / Modem High
CVE
CVE-2026-20479
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT6833、MT6853、MT6855、MT6873、MT6875、MT6877、MT6880、MT6883、MT6885、MT6889、MT6890、MT6891、MT6893、MT8675、MT8771、MT8791、MT8791T、MT8797。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00741071; Issue ID: MSV-7620.
CVE-2026-20481 · MediaTek components / geniezone High
CVE
CVE-2026-20481
组件
MediaTek components / geniezone
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6989、MT8755、MT8768、MT8771、MT8775、MT8781、MT8791T、MT8792、MT8793、MT8796、MT8797、MT8798、MT8799、MT8910。
攻击入口与前提
触发位置：geniezone；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965373; Issue ID: MSV-6935.
CVE-2026-20497 · MediaTek components / geniezone High
CVE
CVE-2026-20497
组件
MediaTek components / geniezone
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT6989、MT8755、MT8768、MT8771、MT8775、MT8781、MT8791T、MT8792、MT8796、MT8797、MT8798。
攻击入口与前提
触发位置：geniezone；攻击位置：本地；所需权限：公告/CNA 未明确；用户交互：不需要；CNA 其他条件（原文）：This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.。
CNA 逐项描述（英文证据）：In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965550 / ALPS11393405; Issue ID: MSV-6941.
CVE-2026-20500 · MediaTek components / Modem High
CVE
CVE-2026-20500
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2716、MT6835、MT6858、MT6878、MT6881、MT6897、MT6899、MT6982VB、MT6986、MT6988、MT6991、MT6993、MT8668、MT8676、MT8678、MT8755、MT8775、MT8792、MT8793、MT8863、MT8873、MT8883。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01810811; Issue ID: MSV-9232.
CVE-2026-20501 · MediaTek components / vdec High
CVE
CVE-2026-20501
组件
MediaTek components / vdec
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2718、MT6580、MT6739、MT6761、MT6765、MT6768、MT6769、MT6779、MT6781、MT6785、MT6789、MT6833、MT6835、MT6853、MT6855、MT6858、MT6873、MT6877、MT6878、MT6879、MT6881、MT6883、MT6885、MT6886、MT6889、MT6893、MT6895、MT6897、MT6899、MT6983、MT6985、MT6989、MT6991、MT6993、MT8126、MT8171、MT8186、MT8188、MT8189、MT8195、MT8196、MT8367、MT8391、MT8395、MT8668、MT8676、MT8678、MT8696、MT8781、MT8788E、MT8792、MT8799、MT8910。
CNA 逐项描述（英文证据）：In vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9197.
CVE-2026-20502 · MediaTek components / vdec High
CVE
CVE-2026-20502
组件
MediaTek components / vdec
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2718、MT6580、MT6739、MT6761、MT6765、MT6768、MT6769、MT6779、MT6781、MT6785、MT6789、MT6833、MT6835、MT6853、MT6855、MT6858、MT6873、MT6877、MT6878、MT6879、MT6881、MT6883、MT6885、MT6886、MT6889、MT6893、MT6895、MT6897、MT6899、MT6983、MT6985、MT6989、MT6991、MT6993、MT8126、MT8171、MT8186、MT8188、MT8189、MT8195、MT8196、MT8367、MT8391、MT8395、MT8668、MT8676、MT8678、MT8696、MT8781、MT8788E、MT8792、MT8799、MT8910。
CNA 逐项描述（英文证据）：In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9196.
CVE-2026-20503 · MediaTek components / Modem High
CVE
CVE-2026-20503
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2716、MT2735、MT2737、MT6813、MT6833、MT6835、MT6853、MT6855、MT6858、MT6873、MT6875、MT6877、MT6878、MT6879、MT6880、MT6881、MT6883、MT6885、MT6886、MT6889、MT6890、MT6891、MT6893、MT6895、MT6896、MT6897、MT6899、MT6980、MT6982VB、MT6983、MT6985、MT6986、MT6988、MT6989、MT6990、MT6991、MT6993、MT8668、MT8673、MT8675、MT8676、MT8678、MT8755、MT8771、MT8775、MT8791、MT8791T、MT8792、MT8793、MT8795T、MT8796、MT8797、MT8798、MT8863、MT8873、MT8883、MT8893。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01371002; Issue ID: MSV-9020.
CVE-2026-20504 · MediaTek components / Modem High
CVE
CVE-2026-20504
组件
MediaTek components / Modem
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
CNA：MediaTek, Inc. / MediaTek chipset — MT2735、MT6833、MT6853、MT6855、MT6873、MT6875、MT6877、MT6880、MT6883、MT6885、MT6889、MT6890、MT6891、MT6893、MT8675、MT8771、MT8791、MT8791T、MT8797。
攻击入口与前提
触发位置：Modem；攻击位置：远程（具体传输通道以逐项描述为准）；所需执行权限：无需额外执行权限；用户交互：不需要；CNA 其他条件（原文）：This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.。
CNA 逐项描述（英文证据）：In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00755024; Issue ID: MSV-7865.
CVE-2026-21383 · Qualcomm closed-source components / Closed-source component High
CNA 逐项描述（英文证据）：Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.
CNA 逐项描述（英文证据）：In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.
CNA 逐项描述（英文证据）：In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CNA 逐项描述（英文证据）：In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CNA 逐项描述（英文证据）：In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CNA 逐项描述（英文证据）：In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CNA 逐项描述（英文证据）：In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
CVE-2026-21732 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.
An edge case using a very large value in switch statements in GPU shader code can cause a segmentation fault in the GPU shader compiler due to an out-of-bounds write access.
CVE-2026-21733 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files.
This is caused by improper handling of GPU memory reservation protections.
CVE-2026-21734 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges this could enable further exploits on the device.
An edge case using a very small value in GPU shader code can cause a segmentation fault in the GPU shader compiler due to am out-of-bounds write.
CVE-2026-22164 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
By creating resources of certain types and presenting a set of parameters to the affected interface the exploit can be used to corrupt kernel memory.
CVE-2026-22166 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the system.
CVE-2026-24079 · Qualcomm closed-source components / Closed-source component High
CNA：Qualcomm, Inc. / Snapdragon — AR8035、CSRA6620、CSRA6640、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、FSM200 Platform、FSM20055、FWA Gen 3 Ultra Platform、G1 Gen 1、Milos、Netrani、Orne、Palawan25、QCA6174A、QCA6391、QCA6574AU、QCA6584AU、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6698AU、QCA6797AQ、QCA8081、QCA8337、QCC710、QCM2290、QCM4325、QCM4490、QCM5430、QCM6490、QCN6024、QCN6224、QCN6274、QCN9011、QCN9012、QCN9024、QCS2290、QCS4290、QCS4490、QCS8550、QEP8111、QFW7114、QFW7124、QMP1000、Qualcomm Video Collaboration VC3 Platform、Robotics RB2 Platform、SD 8 Gen1 5G、SD662、SDX61、SM6225P、SM6650P、SM7325P、SM7435、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM8475P、SM8550P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 460 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 680 4G Mobile Platform、Snapdragon 685 4G Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c+ Gen 3 Compute、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon Auto 5G Modem-RF、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon W5+ Gen 1 Wearable Platform、Snapdragon X32 5G Modem-RF System、Snapdragon X35 5G Modem-RF System、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、SW5100、SW5100P、SW6100、SW6100P、Themisto、WCD9335、WCD9340、WCD9370、WCD9371、WCD9375、WCD9378、WCD9380、WCD9385、WCD9390、WCD9395、WCN3910、WCN3950、WCN3980、WCN3988、WCN6650、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H。
CNA：Qualcomm, Inc. / Snapdragon — AR8035、C110100、Cologne、CQ7790、CQ7790M、CQ8725S、CQ8750M、CQ8845S、FastConnect 6200、FastConnect 6700、FastConnect 6900、FastConnect 7800、FWA Gen 3 Ultra Platform、FWA Gen 5 Elite Platform、G2 Gen 1、G3x Gen 2、IQ8 Series Platform、IQ9 Series Platform、IQX5121、IQX7181、Kobuk、MBM715、Milos、Milos_IOT、Monaco_IOT、Netrani、Orne、Palawan25、Pandeiro、Q-7790、QCA0000、QCA6391、QCA6698AQ、QCA8081、QCA8337、QCA8386、QCC2070、QCC2073、QCC2076、QCC5161、QCC6705、QCC710、QCC711、QCC7225、QCF8001、QCN6224、QCN6274、QCN9011、QCN9012、QCS6690、QCS8550、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMP1000、QMP2001、QPA1083BD、QPA1086BD、Qualcomm FastConnect 8800 Mobile Connectivity System、QXM1083、QXM1086、QXM1093、QXM1094、QXM1095、QXM1096、S3 Gen 2 Sound Platform、S3 Sound Platform、S5 Gen 2 Sound Platform、S5 Sound Platform、SAR1165P、SAR2130P、SC8380XP、SDX81、SM6450P、SM6475P、SM6475Q、SM6650P、SM6850、SM7435、SM7435P、SM7525、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM7750P、SM8550P、SM8635、SM8635P、SM8650Q、SM8735P、SM8750P、SM8845P、SM8950、SM8950P、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 7 Gen 4 Mobile Platform、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8 Gen 5、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon AR1+ Gen 1 Platform、Snapdragon S7 Sound Gen 1 Platforms、Snapdragon X2 Elite、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、Snapdragon Reality Elite Platform、SW-only、SXR2230P、SXR2250P、WCD9340、WCD9370、WCD9371、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3988、WCN6450、WCN6650、WCN6755、WCN7760、WCN7860、WCN7861、WCN7880、WCN7881、WCN8841、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、WSA8850、WSA8850W、WSA8855C、X1E80100、XRV7209、XRV9209。
CNA：Qualcomm, Inc. / Snapdragon — 5G Fixed Wireless Access Platform、AQT1000、AR8035、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、FWA Gen 3 Ultra Platform、Milos、Netrani、Orne、Palawan25、QCA6174A、QCA6391、QCA6420、QCA6430、QCA6574AU、QCA6584AU、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6698AU、QCA6797AQ、QCA8081、QCA8337、QCC710、QCM4490、QCM5430、QCM6490、QCN6024、QCN6224、QCN6274、QCN9011、QCN9012、QCN9024、QCS4490、QCS8550、QFW7114、QFW7124、QMP1000、Qualcomm Video Collaboration VC3 Platform、SD 8 Gen1 5G、SDX57M、SDX61、SDX71M、SM6650P、SM7325P、SM7435、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM8475P、SM8550P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c+ Gen 3 Compute、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon 8c Compute Platform "Poipu Lite"、Snapdragon 8cx Compute Platform、Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro"、Snapdragon Auto 5G Modem-RF、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon X70 Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、Snapdragon X80 5G Modem-RF System、SnapdragonAuto 4GModem、WCD9340、WCD9341、WCD9370、WCD9371、WCD9375、WCD9378、WCD9380、WCD9385、WCD9390、WCD9395、WCN3950、WCN3988、WCN6650、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H。
CNA：Qualcomm, Inc. / Snapdragon — Snapdragon G1 Gen 2 Gaming Platform、5G Fixed Wireless Access Platform、AQT1000、AR8031、AR8035、C110100、Cologne、Congo、CQ2390M、CQ2390S、CQ7790、CQ7790M、CQ8725S、CQ8750M、CQ8845S、CSR8811、CSRA6620、CSRA6640、CSRB31024、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、Flight RB5 5G Platform、FWA Gen 3 Ultra Platform、FWA Gen 5 Elite Platform、G1 Gen 1、G2 Gen 1、G3x Gen 2、Immersive Home 214 Platform、Immersive Home 216 Platform、Immersive Home 316 Platform、Immersive Home 318 Platform、Immersive Home 3210 Platform、Immersive Home 326 Platform、IPQ5010、IPQ5028、IPQ5302、IPQ5312、IPQ5332、IPQ6000、IPQ6010、IPQ6018、IPQ8070、IPQ8071、IPQ8072、IPQ8074、IPQ8076、IPQ8078、IPQ9008、IPQ9554、IPQ9570、IPQ9574、IQ10 Series、IQ6 Series Platform、IQ8 Series Platform、IQ9 Series Platform、IQX5121、IQX7181、Kalpeni、Kobuk、LeMans_AU_LGIT、LeMansAU、Marina、MBM415、MBM715、Milos、Milos_IOT、Monaco_IOT、Netrani、Networking Pro 1200 Platform、Networking Pro 1210 Platform、Networking Pro 1610 Platform、Networking Pro 400 Platform、Networking Pro 600 Platform、Networking Pro 610 Platform、Networking Pro 800 Platform、Networking Pro 810 Platform、NPro A8 Elite Platform、Orne、Palawan25、Pandeiro、PMP8074、Q-4390、Q-7790、QAM8255P、QAM8295P、QAMSRV1H、QAMSRV1M、QCA0000、QCA2062、QCA2064、QCA2065、QCA2066、QCA4024、QCA6391、QCA6420、QCA6428、QCA6430、QCA6438、QCA6554A、QCA6564AU、QCA6574、QCA6574A、QCA6574AU、QCA6584AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6698AU、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8072、QCA8075、QCA8080、QCA8081、QCA8082、QCA8084、QCA8085、QCA8337、QCA8386、QCA8695AU、QCA9888、QCA9889、QCC2070、QCC2073、QCC2076、QCC6705、QCC710、QCF8000、QCF8001、QCM2290、QCM4290、QCM4325、QCM4490、QCM5430、QCM6125、QCM6490、QCN5021、QCN5022、QCN5024、QCN5052、QCN5054、QCN5064、QCN5122、QCN5124、QCN5152、QCN5154、QCN5164、QCN5550、QCN6023、QCN6024、QCN6122、QCN6132、QCN6224、QCN6274、QCN6402、QCN6412、QCN6422、QCN6432、QCN7605、QCN7606、QCN9000、QCN9001、QCN9002、QCN9003、QCN9011、QCN9012、QCN9022、QCN9024、QCN9070、QCN9100、QCN9274、QCS2290、QCS4290、QCS4490、QCS6690、QCS8550、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMP1000、QMP2001、QPA1083BD、QPA1086BD、Qualcomm FastConnect 8800 Mobile Connectivity System、Qualcomm Video Collaboration VC1 Platform、Qualcomm Video Collaboration VC3 Platform、Qualcomm Video Collaboration VC5 Platform、QXM1083、QXM1086、QXM1093、QXM1094、QXM1095、QXM1096、Robotics RB2 Platform、Robotics RB5 Platform、SA4150P、SA4155P、SA510M、SA6145P、SA6150P、SA6155、SA6155P、SA7255P、SA7775P、SA8145P、SA8150P、SA8155、SA8155P、SA8195P、SA8255P、SA8295P、SA8620P、SA8770P、SA9000P、SAR1165P、SAR2130P、SC8380XP、SD 8 Gen1 5G、SD662、SD865 5G、SDA660、SDX65M、SDX81、SM4850、SM4850P、SM4875、SM6225P、SM6250、SM6450P、SM6475P、SM6475Q、SM6650P、SM6850、SM7325P、SM7435、SM7435P、SM7525、SM7550、SM7550P、SM7635P、SM7675、SM7675P、SM7750P、SM8475P、SM8550P、SM8635、SM8635P、SM8650Q、SM8735P、SM8750P、SM8845P、SM8950、SM8950P、SM8975、SM8975P、Smart Audio 400 Platform、Snapdragon 4 Gen 1 Mobile Platform、Snapdragon 4 Gen 2 Mobile Platform、Snapdragon 460 Mobile Platform、Snapdragon 480 5G Mobile Platform、Snapdragon 480+ 5G Mobile Platform、Snapdragon 6 Gen 1 Mobile Platform、Snapdragon 6 Gen 3 Mobile Platform、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 660 Mobile Platform、Snapdragon 662 Mobile Platform、Snapdragon 680 4G Mobile Platform、Snapdragon 685 4G Mobile Platform、Snapdragon 690 5G Mobile Platform、Snapdragon 695 5G Mobile Platform、Snapdragon 7 Gen 1 Mobile Platform、Snapdragon 7 Gen 4 Mobile Platform、Snapdragon 7+ Gen 2 Mobile Platform、Snapdragon 778G 5G Mobile Platform、Snapdragon 778G+ 5G Mobile Platform、Snapdragon 782G Mobile Platform、Snapdragon 7c Compute Platform、Snapdragon 7c Gen 2 Compute Platform "Rennell Pro"、Snapdragon 7c+ Gen 3 Compute、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8 Gen 5、Snapdragon 8+ Gen 1 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon 888 5G Mobile Platform、Snapdragon 888+ 5G Mobile Platform、Snapdragon 8c Compute Platform "Poipu Lite"、Snapdragon 8c Compute Platform (SC8180XP-AD) "Poipu Lite"、Snapdragon 8cx Compute Platform、Snapdragon 8cx Compute Platform "Poipu Pro"、Snapdragon 8cx Gen 2 5G Compute Platform、Snapdragon 8cx Gen 2 5G Compute Platform "Poipu Pro"、Snapdragon 8cx Gen 3 Compute Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon AR1+ Gen 1 Platform、Snapdragon Auto 5G Modem-RF、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon Ride Elite、Snapdragon W5+ Gen 1 Wearable Platform、Snapdragon X2 Elite、Snapdragon X35 5G Modem-RF System、Snapdragon X53 5G Modem-RF System、Snapdragon X55 5G Modem-RF System、Snapdragon X65 5G Modem-RF System、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、Snapdragon XR2 5G Platform、Snapdragon XR2+ Gen 1 Platform、SnapdragonAuto 4GModem、Snapdragon Cockpit Elite、Snapdragon Reality Elite Platform、SRV1H、SRV1M、SW-only、SW5100、SW5100P、SXR2230P、SXR2250P、Trestles、Vision Intelligence 400 Platform、WCD9335、WCD9340、WCD9341、WCD9360、WCD9370、WCD9371、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3910、WCN3950、WCN3980、WCN3988、WCN3990、WCN6450、WCN6650、WCN6755、WCN7760、WCN7860、WCN7861、WCN7880、WCN7881、WCN8841、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、WSA8850、WSA8850W、WSA8855C、X1E80100、XRV7209、XRV9209。
CNA：Qualcomm, Inc. / Snapdragon — Cologne、CQ7790、FastConnect 6900、FastConnect 7800、Orne、Palawan25、Pandeiro、QCM8838、QLN1083BD、QLN1086BD、QMB715、QMP1000、QPA1083BD、QPA1086BD、QXM1093、QXM1094、QXM1095、QXM1096、SC8380XP、SDR753、Snapdragon 7 Gen 4 Mobile Platform、Snapdragon 8 Elite Gen 5、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9395、WCN6755、WCN7860、WCN7861、WSA8840、WSA8845、WSA8845H、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039、XRV7209、XRV9209。
CNA：Qualcomm, Inc. / Snapdragon — AR8035、Cologne、CQ7790、CQ8725S、CQ8750M、FastConnect 6200、FastConnect 6700、FastConnect 6800、FastConnect 6900、FastConnect 7800、FWA Gen 3 Ultra Platform、FWA Gen 5 Elite Platform、G2 Gen 1、Immersive Home 3210 Platform、Immersive Home 326 Platform、IPQ5300、IPQ5302、IPQ5312、IPQ5332、IPQ9554、IPQ9570、IPQ9574、IQ10 Series、IQX5121、IQX7181、Kobuk、LeMans_AU_LGIT、LeMansAU、Milos、Milos_IOT、Networking Pro 1210 Platform、Networking Pro 1610 Platform、Networking Pro 610 Platform、Networking Pro 810 Platform、Orne、Palawan25、Pandeiro、QAM8255P、QAM8397P、QAM8797P、QAMSRV1H、QAMSRV1M、QCA0000、QCA6391、QCA6426、QCA6436、QCA6554A、QCA6564AU、QCA6574、QCA6574A、QCA6574AU、QCA6584AU、QCA6595、QCA6595AU、QCA6678AQ、QCA6688AQ、QCA6696、QCA6698AQ、QCA6698AU、QCA6777AQ、QCA6787AQ、QCA6797AQ、QCA8075、QCA8081、QCA8337、QCA8386、QCA8695AU、QCC2073、QCC2076、QCC710、QCF8000、QCF8001、QCM8550、QCM8838、QCN5124、QCN6224、QCN6274、QCN6402、QCN6412、QCN6422、QCN6432、QCN9011、QCN9012、QCN9274、QCS6690、QCS8550、QFW7114、QFW7124、QLN1083BD、QLN1086BD、QMB715、QMP1000、QPA1083BD、QPA1086BD、QXM1083、QXM1086、QXM1093、QXM1094、QXM1095、QXM1096、SA7255P、SA7775P、SA8255P、SA8620P、SA8770P、SA9000P、SAR1165P、SAR2130P、SC8380XP、SD 8 Gen1 5G、SD865 5G、SDR753、SDX81、SM6650P、SM7635P、SM7675、SM7675P、SM8550P、SM8635、SM8635P、SM8650Q、SM8750P、Snapdragon 6 Gen 4 Mobile Platform、Snapdragon 7 Gen 4 Mobile Platform、Snapdragon 7s Gen 3 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 1 Mobile Platform、Snapdragon 8 Gen 2 Mobile Platform、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8+ Gen 2 Mobile Platform、Snapdragon 865 5G Mobile Platform、Snapdragon 865+ 5G Mobile Platform、Snapdragon 870 5G Mobile Platform、Snapdragon AR1 Gen 1 Platform、Snapdragon AR1+ Gen 1 Platform、Snapdragon Auto 5G Modem-RF Gen 2、Snapdragon X72 5G Modem-RF System、Snapdragon X75 5G Modem-RF System、Snapdragon XR2 5G Platform、Snapdragon Wear Elite platform、SRV1H、SRV1M、SSG2115P、SSG2125P、SXR1230P、SXR2230P、SXR2250P、SXR2330P、SXR2350P、Themisto、WCD9340、WCD9370、WCD9375、WCD9378、WCD9378C、WCD9380、WCD9385、WCD9390、WCD9395、WCN3988、WCN6450、WCN6650、WCN6740、WCN6755、WCN7860、WCN7861、WCN7880、WCN7881、WSA8810、WSA8815、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、X1E80100、X2000077、X2000086、X2000090、X2000092、X2000094、XG101002、XG101032、XG101039、XRV7209、XRV9209。
CNA 逐项描述（英文证据）：Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.
CVE-2026-25294 · Qualcomm closed-source components / Closed-source component High
CNA：Qualcomm, Inc. / Snapdragon — Cologne、Congo、CQ7790、CQ7790M、CQ8845S、FastConnect 6200、FastConnect 6700、FastConnect 6900、FastConnect 7800、MBM715、Orne、Palawan25、Pandeiro、Q-7790、QLN1083BD、QLN1086BD、QMP1000、QMP2001、QPA1083BD、QPA1086BD、Qualcomm FastConnect 8800 Mobile Connectivity System、QXM1093、QXM1094、QXM1095、QXM1096、SC8380XP、SM4875、SM6850、SM7675、SM7675P、SM7750P、SM8635、SM8635P、SM8650Q、SM8735P、SM8750P、SM8845P、SM8950、SM8950P、SM8975、SM8975P、Snapdragon 7 Gen 4 Mobile Platform、Snapdragon 8 Elite、Snapdragon 8 Elite Gen 5、Snapdragon 8 Gen 3 Mobile Platform、Snapdragon 8 Gen 5、SW-only、WCD9370、WCD9375、WCD9378、WCD9380、WCD9385、WCD9390、WCD9395、WCN3988、WCN6450、WCN6755、WCN7760、WCN7860、WCN7861、WCN7880、WCN7881、WCN8841、WSA8830、WSA8832、WSA8835、WSA8840、WSA8845、WSA8845H、WSA8850、WSA8850W、WSA8855C、X1E80100、XRV7209、XRV9209。
具体攻击入口未在公告中细分；参照下方 CNA 逐项描述；所需权限：公告/CNA 未明确；用户交互：公告/CNA 未明确；CNA CVSS 向量：CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H；CNA 其他条件（原文）：Exploitation of this issue requires user interaction in that a victim must open a malicious file.。
CNA 逐项描述（英文证据）：DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CNA 逐项描述（英文证据）：In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local escalation with User execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28589 · Pixel / Settings High
CVE
CVE-2026-28589
组件
Pixel / Settings
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
权限提升（EoP）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
触发位置：getItemList of SettingsFragment.java；攻击位置：本地；所需执行权限：无需额外执行权限；用户交互：不需要。
安全影响
权限提升（EoP）
漏洞成因分析
已披露位置：getItemList of SettingsFragment.java。CNA 缺陷分类：Elevation of privilege。CNA 披露的原因是：misleading or insufficient UI。该描述尚不足以定位具体错误代码或完整失效路径，不能仅凭组件或等级补写未经验证的细节。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: add missing return after LLCP_CLOSED checks
In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket
state is LLCP_CLOSED, the code correctly calls release_sock() and
nfc_llcp_sock_put() but fails to return. Execution falls through to
the remainder of the function, which calls release_sock() and
nfc_llcp_sock_put() again. This results in a double release_sock()
and a refcount underflow via double nfc_llcp_sock_put(), leading to
a use-after-free.
Add the missing return statements after the LLCP_CLOSED branches
in both functions to prevent the fall-through.
具体攻击入口未在公告中细分；参照下方 CNA 逐项描述；所需权限：公告/CNA 未明确；用户交互：公告/CNA 未明确；CNA CVSS 向量：CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H；CNA 其他条件（原文）：This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled.。
CNA 逐项描述（英文证据）：LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.
CVE-2026-34192 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables.
The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not cleanup properly before freeing the physical allocation.
CVE-2026-34193 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory.
A logic error in the address translation allowed a compromised Host (Kernel) to perform arbitrary writes to firmware memory.
CVE-2026-34194 · Imagination Technologies / PowerVR-GPU High
CNA 缺陷分类：CWE-468: Incorrect Pointer Scaling。CNA 披露的原因是：the semantics of how math operations are implicitly scaled across buffers of different sizes。该描述尚不足以定位具体错误代码或完整失效路径，不能仅凭组件或等级补写未经验证的细节。以上机制解释依据本 CVE 的 CNA 描述及缺陷分类；具体代码修复仅在本月重点补丁分析中经逐项核对后说明。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintained for a sparse memory allocation.
The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.
CVE-2026-34195 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel.
The product incorrectly indexes internal state when performing sparse allocation remapping.
CVE-2026-34196 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the second mapping
The second virtual mapping references a physical address that has been freed after the first virtual mapping has been freed. This allows the physical memory to be allocated (for example) by another process and read/written to.
CVE-2026-41156 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario.
A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing it.
CVE-2026-41157 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash.
The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur past the intended memory boundary, corrupting adjacent memory and causing process instability or termination.
CVE-2026-41158 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages.
Physical memory allocated and freed, without the deferred free mechanism can lead to those resources being used for read/write by the GPU after the kernel module has freed the resource.
CVE-2026-43049 · Kernel / Human Interface Device High
CNA 逐项描述（英文证据）：In the Linux kernel, the following vulnerability has been resolved:
HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
Presently, if the force feedback initialisation fails when probing the
Logitech G920 Driving Force Racing Wheel for Xbox One, an error number
will be returned and propagated before the userspace infrastructure
(sysfs and /dev/input) has been torn down. If userspace ignores the
errors and continues to use its references to these dangling entities, a
UAF will promptly follow.
We have 2 options; continue to return the error, but ensure that all of
the infrastructure is torn down accordingly or continue to treat this
condition as a warning by emitting the message but returning success.
It is thought that the original author's intention was to emit the
warning but keep the device functional, less the force feedback feature,
so let's go with that.
CVE-2026-45195 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.
Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.
CVE-2026-45196 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.
CVE-2026-45197 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory.
The firmware uses data provided by the Guest VM to set up accesses to memory. It validated this before use, but a TOCTOU bug was present which allowed the earlier check results to be invalidated.
CVE-2026-45198 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software from a non-secure operating system on a platform with Trusted Execution Environment support, may cause GPU Firmware to boot up using data from non-secure memory.
The GPU thread of control (Firmware) uses a pointer from non-secure memory belonging to the Rich Execution Environment (REE) when saving or retrieving internal data between the tightly coupled private memory to main memory. An attacker with control over the REE kernel may modify the pointer value, corrupting the data used by the GPU Firmware.
CVE-2026-45200 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption.
Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.
CVE-2026-45202 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct GPU system calls which cause GPU memory leaks and possible kernel heap corruption.
Scenario caused by memory free paths not maintaining state data of upgraded higher order allocations. This could cause memory leak or double free event.
CVE-2026-45203 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel.
A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.
CNA 逐项描述（英文证据）：In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.
CVE-2026-49743 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs.
During workload submission involving a fence exported by the GPU driver, the reference count of the underlying synchronisation primitive is not properly incremented. This can be exploited, by destroying the exported fence and prematurely release the underlying primitive, resulting in a potential use-after-free condition.
CVE-2026-49744 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes virtualization boundaries.
CVE-2026-49745 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory.
Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. These can be used to escalate privileges.
CVE-2026-49746 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct improper GPU system calls to cause OOB read kernel memory access and in certain cases cause GPU UAF of arbitrary pages.
Incorrect validation of array index can lead to OOB read and potentially to GPU UAF of arbitrary pages.
CNA 逐项描述（英文证据）：In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-49926 · System Critical
CVE
CVE-2026-49926
组件
System
官方等级
Critical（严重）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
公告列出已更新的 AOSP 分支：16-qpr2, 17（这不是全部受影响设备清单）。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
拒绝服务（DoS）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-52993 · Kernel components / Transparent Inter-Process Communication Critical
CVE
CVE-2026-52993
组件
Kernel components / Transparent Inter-Process Communication
CNA 逐项描述（英文证据）：In the Linux kernel, the following vulnerability has been resolved:
tipc: fix double-free in tipc_buf_append()
tipc_msg_validate() can potentially reallocate the skb it is validating,
freeing the old one. In tipc_buf_append(), it was being called with a
pointer to a local variable which was a copy of the caller's skb
pointer.
If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.
Fix this by checking if head now points to a newly allocated reassembled
skb. If it does, reassign *headbuf for later freeing operations.
CNA 逐项描述（英文证据）：In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In addr_remap_address_map of remap.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55305 · Pixel / Telephony High
CVE
CVE-2026-55305
组件
Pixel / Telephony
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
信息泄露（ID）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55318 · Pixel / IP Multimedia Subsystem Critical
CNA 逐项描述（英文证据）：In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55323 · Pixel / Goodix Fingerprint TA Critical
CNA 逐项描述（英文证据）：In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55326 · Pixel / Bootloader High
CVE
CVE-2026-55326
组件
Pixel / Bootloader
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
权限提升（EoP）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55337 · Pixel / Bootloader Critical
CVE
CVE-2026-55337
组件
Pixel / Bootloader
官方等级
Critical（严重）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
权限提升（EoP）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55355 · Pixel / Bootloader High
CVE
CVE-2026-55355
组件
Pixel / Bootloader
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
权限提升（EoP）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55364 · Pixel / Bootloader Critical
CVE
CVE-2026-55364
组件
Pixel / Bootloader
官方等级
Critical（严重）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
权限提升（EoP）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56885 · Pixel / Telephony Moderate
CVE
CVE-2026-56885
组件
Pixel / Telephony
官方等级
Moderate（中）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
权限提升（EoP）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56896 · Pixel / Telephony High
CVE
CVE-2026-56896
组件
Pixel / Telephony
官方等级
High（高）；按 Google 公告保留，不用 CVSS 分数替换
影响范围
本月 Pixel 公告所涉受支持设备及相应组件；不能推及所有 Pixel 型号。
攻击入口与前提
本条未取得公开 CNA 描述；公告未逐项公开触发入口、权限和交互条件，不能从同一组件其他漏洞推断。
安全影响
权限提升（EoP）
漏洞成因分析
CVE Program 公开接口对该编号返回 HTTP 404，未取得可审阅的 CNA 描述。Google 公告仅给出本条组件、等级、类型及引用编号，尚不足以解释具体根因；不借用相似 CVE 的机制，也不擅自更换编号。
利用状态
所查 Google 公告未披露该项在野利用，且 CISA KEV 无截至文章日期的收录记录；不代表不存在利用；公开 PoC 状态未由这些来源确认。
CNA 逐项描述（英文证据）：In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56914 · Kernel components / Google eXperience Processor High
CNA 逐项描述（英文证据）：In multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In s_decode_vui_param of fw_hevc_dec_header.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In CPM, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56970 · Pixel / IP Multimedia Subsystem High
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CNA 逐项描述（英文证据）：In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple files, there is a possible way to obtain signatures due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-56986 · Pixel / Android Verified Boot High
CNA 逐项描述（英文证据）：In multiple files, there is a possible out-of-bounds read due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple files, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In acfw_ffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU processing operations to access already freed memory.
This issue affects Valhall GPU Kernel Driver: from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r50p0 through r54p3, r55p0.
CNA 逐项描述（英文证据）：In Bootloader, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58679 · Pixel / Goodix Fingerprint TA Critical
CNA 逐项描述（英文证据）：In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of physmem_extmem_linux.c, there is a possible out-of-bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple locations, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CNA 逐项描述（英文证据）：Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r49p3 through r49p5, r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r49p3 through r49p5, from r51p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r49p3 through r49p5, from r51p0 through r54p3, r55p0.
CNA 逐项描述（英文证据）：Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform valid GPU memory processing operations to access already freed memory.
This issue affects Bifrost GPU Kernel Driver: from r44p0 through r49p4, from r50p0 through r51p0, from r54p1 through r54p2; Valhall GPU Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r49p5, from r50p0 through r54p3, r55p0.
CVE-2026-7639 · Imagination Technologies / PowerVR-GPU High
CNA 逐项描述（英文证据）：Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code.
Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.