CVE-2026-49883

In the parseParts function of PduParser.java, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to local privilege escalation without additional execution privileges. User interaction is not required for exploitation.

In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local privilege escalation without additional execution privileges. User interaction is not required for exploitation.

In the WriteImageToDisk function of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local privilege escalation without additional execution privileges. User interaction is not required for exploitation.

Android allows users to cause a denial of service.

In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.

In multiple functions of AppOpsService.java, there is a missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed.