NCSC-2026-0173

Vulnerability from csaf_ncscnl - Published: 2026-06-02 08:00 - Updated: 2026-06-02 08:00
Summary
Kwetsbaarheden verholpen in Google Android en Samsung Mobile
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Google heeft kwetsbaarheden verholpen in Android. Samsung heeft de voor Samsung mobile devices relevante kwetsbaarheden verholpen in Samsung Mobile.
Interpretaties: Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige code uit te voeren. Onder de verholpen kwetsbaarheden zit een aantal kwetsbaarheden die door Google worden gemarkeerd als 'Critical'. Google heeft verder, zoals gebruikelijk, weinig detailinformatie beschikbaar gesteld.
Oplossingen: Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14. Samsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-20: Improper Input Validation
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121: Stack-based Buffer Overflow
CWE-122: Heap-based Buffer Overflow
CWE-125: Out-of-bounds Read
CWE-126: Buffer Over-read
CWE-129: Improper Validation of Array Index
CWE-190: Integer Overflow or Wraparound
CWE-269: Improper Privilege Management
CWE-400: Uncontrolled Resource Consumption
CWE-416: Use After Free
CWE-476: NULL Pointer Dereference
CWE-617: Reachable Assertion
CWE-693: Protection Mechanism Failure
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
CWE-1021: Improper Restriction of Rendered UI Layers or Frames
CWE-1286: Improper Validation of Syntactic Correctness of Input
CVE-2025-22424

Improper input validation in multiple locations can allow users to access images across accounts, potentially leading to local privilege escalation without additional execution privileges, requiring user interaction for exploitation.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-22426

A logic error in ComputerEngine.java permits unauthorized access to user URIs, enabling local privilege escalation without additional execution privileges or user interaction.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-32348

A missing permission check in multiple locations allows background activity launches, potentially enabling local privilege escalation without user interaction or additional execution privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-47384

A transient denial of service (DoS) condition arises when the MAC is configured with a configuration ID exceeding its supported maximum value, causing temporary service disruption.

6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-47392

Memory corruption occurs during the decoding of corrupted satellite data files containing invalid signature offsets, potentially leading to system instability or exploitation.

8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-47400

A cryptographic vulnerability occurs when data is copied to a destination buffer without verifying the buffer's size, potentially causing security issues such as buffer overflows.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-47401

A transient denial of service vulnerability occurs during the processing of target power rate tables in channel configuration, potentially disrupting normal device operation.

6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-47403

A transient denial-of-service condition may occur during wireless roaming when a malformed Fast Transition response frame with an invalid header structure is processed.

6.5 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-48570

PipTaskOrganizer.java contains multiple confused deputy vulnerabilities enabling background activity launches that may lead to local privilege escalation without user interaction or additional execution privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-48595

An integer overflow vulnerability present in multiple locations can enable local privilege escalation without requiring additional execution privileges or user interaction.

8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-48615

A resource exhaustion issue in getComponentName of MediaButtonReceiverHolder.java may cause desynchronization in persistence, enabling local privilege escalation without user interaction or additional privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-48649

A permissions bypass vulnerability in multiple locations allows resetting user-selected permissions, potentially enabling local privilege escalation without additional execution privileges or user interaction.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-48652

A logic error in the performPreInstallChecks function of InstallRepository.kt enables bypassing MDM policy, allowing local privilege escalation without additional execution privileges or user interaction.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-59604

Memory corruption arises during a memory copy operation due to invalid writes triggered by a null pointer dereference, leading to potential instability or exploitation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-59605

Memory corruption vulnerabilities arise from processing device identifier strings that exceed their expected maximum length, potentially leading to unstable system behavior or exploitation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-59606

Memory corruption occurs due to heap memory exhaustion during secure data initialization, leading to writes in invalid memory locations.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-64505

Multiple vulnerabilities in libpng, including heap buffer over-reads and overflows in functions like png_do_quantize and png_image_read_composite, affect various products such as MySQL Workbench, NetApp, Oracle Hyperion, and Apple Software, potentially causing data disclosure, denial of service, or application crashes.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-64720

Libpng versions prior to 1.6.51 contain multiple memory handling vulnerabilities including out-of-bounds reads and buffer overflows in functions like png_image_read_composite, png_do_quantize, and png_combine_row, affecting various products such as MySQL Workbench and NetApp devices.

7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2025-65018

Multiple heap buffer overflow and out-of-bounds read vulnerabilities exist in libpng versions 1.6.0 to before 1.6.51, affecting functions like png_image_finish_read and png_combine_row, impacting products from Oracle, NetApp, and others.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0009

A logic error in the code enables tapjacking vulnerabilities at multiple points, allowing local privilege escalation without requiring additional execution privileges or user interaction.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0016

A permissions bypass vulnerability in CredentialManagerService.java's updateProvidersWhenServiceRemoved function allows overriding settings across users, potentially leading to local information disclosure without extra privileges or user interaction.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0018

AccessibilityManagerService.java contains multiple functions with inadequate input validation, leading to a persistent local denial of service without requiring user interaction or elevated privileges.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0036

A tapjacking vulnerability in the startAnimation method of StageCoordinator.java enables local privilege escalation without requiring user interaction or additional execution privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0039

A remote denial of service vulnerability caused by an integer overflow exists in multiple functions of ubsan_throwing_runtime.cpp, exploitable without user interaction or elevated privileges.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0040

An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0041

A potential integer overflow in multiple functions of ubsan_throwing_runtime.cpp can cause a UBSan failure, resulting in a remote denial of service without user interaction or elevated privileges.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0042

A vulnerability in ubsan_throwing_runtime.cpp functions can lead to a persistent local denial of service via resource exhaustion without requiring user interaction or elevated privileges.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0043

A vulnerability in ubsan_throwing_runtime.cpp involving integer overflow can lead to persistent denial of service and local privilege escalation without requiring user interaction or elevated privileges.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0044

A vulnerability in ubsan_throwing_runtime.cpp involving an integer overflow can cause a system crash, potentially enabling remote denial of service without user interaction or additional privileges.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0046

A vulnerability in InputInterceptor of Letterbox.java enables a tapjacking/overlay attack that can trick users into granting permissions, potentially causing local privilege escalation without user interaction or extra execution privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0048

A vulnerability in WindowState.java enables a tapjacking or overlay attack that can deceive users into granting permissions, potentially resulting in local privilege escalation without additional execution privileges or user interaction.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0051

A vulnerability in multiple functions of ubsan_throwing_runtime.cpp allows remote denial of service via improper input validation, exploitable without user interaction or additional privileges.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0052

An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0055

A path traversal vulnerability in PackageInstallerService.java's createSessionInternal method allows local privilege escalation by enabling updates to a Device Policy Controller in unauthorized directories without user interaction or extra privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0056

A vulnerability in ResourceTypes.cpp's setTo function may lead to an out-of-bounds read, potentially causing local information disclosure without user interaction or elevated privileges.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0059

A heap buffer overflow vulnerability in multiple functions of sdp_discovery.cc could enable remote code execution without requiring additional privileges or user interaction.

8.0 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0061

WindowState.java contains multiple functions vulnerable to tapjacking and overlay attacks that can deceive users into granting permissions, enabling local privilege escalation without additional execution privileges or user interaction.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0069

A vulnerability in the verifySignature function of ApkChecksums.java can cause resource exhaustion leading to a crash and local denial of service without user interaction or elevated privileges.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0070

A vulnerability in DevicePolicyManagerService.java allows hiding a critical system package via improper input validation, enabling a local denial of service without user interaction or additional privileges.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0076

An out-of-bounds read vulnerability in the validateNode function of ResourceTypes.cpp due to improper bounds checking may enable local privilege escalation without additional execution privileges or user interaction.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0077

A logic error in resumeConfigurationDispatch within ActivityRecord.java can trigger background application launches, enabling local privilege escalation without user interaction or elevated execution privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0078

A vulnerability in DevicePolicyManagerService.java's setGlobalProxy method allows local privilege escalation without user interaction due to improper input validation causing persistence desynchronization.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0080

An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0087

A logic error in DomainVerificationService.java's approvalLevelForDomainInternal function enables hijacking of arbitrary app links, leading to local privilege escalation without user interaction or extra execution privileges.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0089

A missing permission check in multiple functions of PackageInstallerService.java enables installation of unverified applications, potentially causing local privilege escalation without user interaction or additional execution privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0091

An over-privileged shell user in the launcher process enables code execution that results in local privilege escalation without requiring user interaction or additional execution privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0097

A logic error in multiple locations allows bypassing user interaction during LE device pairing, enabling remote privilege escalation without requiring additional execution privileges.

8.0 (High)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-0100

A heap buffer overflow vulnerability in LoadedArsc.cpp can lead to an out-of-bounds write, enabling local privilege escalation without user interaction or additional execution privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21017

A vulnerability in SecTelephonyProvider before SMR Jun-2026 Release 1 allows local attackers to access privileged files due to improper privilege handling.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21025

A vulnerability in Telephony before SMR Jun-2026 Release 1 allows local attackers to access sensitive information due to incorrect privilege assignment, posing a significant security risk.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21026

A vulnerability in SpriteWallpaper before SMR Jun-2026 Release 1 allows local attackers to access sensitive information due to improper export of Android application components.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21027

An improper export vulnerability in Android's ImsSettings component before SMR June 2026 Release 1 allows local attackers to trigger the logging function.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21028

An improper access control vulnerability in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21029

A vulnerability in Galaxy Editing Service before SMR Jun-2026 Release 1 allows local attackers to perform privileged operations by exploiting improper export of Android application components.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21030

An improper access control vulnerability in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to execute privileged functions, posing a significant security risk.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21031

An improper authorization vulnerability in AppBlock before SMR Jun-2026 Release 1 allows a local attacker to launch arbitrary activities, requiring user interaction to exploit.

Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21352

DNG SDK versions 1.7.1 2410 and earlier have an out-of-bounds write vulnerability that may allow arbitrary code execution when processing malicious files.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21353

DNG SDK versions 1.7.1 2410 and earlier contain an Integer Overflow vulnerability that allows arbitrary code execution when a malicious file is opened.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21367

A transient denial of service vulnerability arises from processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial network scans, potentially disrupting normal device operations.

7.6 (High)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21372

Memory corruption vulnerabilities arise from sending IOCTL requests with invalid buffer sizes during memcpy operations, potentially leading to unstable system behavior or exploitation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21373

Memory corruption vulnerabilities can arise when output buffer sizes are not properly validated during IOCTL processing, potentially leading to system instability or exploitation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21374

A memory corruption vulnerability arises from insufficient buffer size validation during the processing of auxiliary sensor input/output control commands, potentially leading to unstable system behavior.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21375

Memory corruption vulnerabilities can arise when output buffer sizes are not properly validated during IOCTL processing, potentially leading to system instability or exploitation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21376

A memory corruption vulnerability exists in a camera sensor driver caused by insufficient validation of output buffer size during IOCTL processing, potentially leading to system instability or exploitation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21378

A memory corruption vulnerability exists in a camera sensor driver caused by insufficient validation of output buffer size during IOCTL processing, potentially leading to system instability or exploitation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21380

Memory corruption vulnerabilities arise from the use of deprecated DMABUF IOCTL calls for video memory management, potentially impacting system stability and security.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21381

A transient denial-of-service vulnerability arises when a device processes a service data frame with excessive length during device matching over a Neighborhood Awareness Network protocol connection.

7.6 (High)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CWE-126 - Buffer Over-read
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-21547
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-23787
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-24085

Memory corruption arises during the processing of display command line information due to an uninitialized variable, potentially leading to unstable system behavior or security risks.

7.2 (High)
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-121 - Stack-based Buffer Overflow
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-24089

Memory corruption vulnerability arises from processing fastboot commands with invalid input, potentially leading to unstable system behavior or exploitation.

7.2 (High)
CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-25276

A memory corruption vulnerability arises in Strongbox due to the absence of a bounds check, potentially leading to unstable behavior or exploitation.

8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-129 - Improper Validation of Array Index
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-25277

A buffer overflow vulnerability in Strongbox leads to memory corruption, potentially compromising system stability and security.

8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-28577

A tapjacking vulnerability in the addWindow method of WindowManagerService.java enables local privilege escalation without user interaction or additional execution privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-28578

DevicePolicyManagerService.java contains multiple functions with improper input validation that can cause desynchronization from persistence, potentially resulting in a local denial of service without user interaction or elevated privileges.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-28580

A bounds check error in multiple functions can cause persistence desynchronization, leading to local privilege escalation without requiring additional execution privileges or user interaction.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
CVE-2026-28586

AppOpsService.java contains multiple functions lacking proper permission checks, potentially enabling local information disclosure without user interaction or elevated execution privileges.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Product Identifier Version Remediation
vers:unknown/*
Google / Android
 vers:unknown/*
vers:unknown/*
Samsung / Mobile Devices
 vers:unknown/*
References
URL Category
https://security.samsungmobile.com/securityUpdate… external
https://source.android.com/docs/security/bulletin… external
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… self
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Google heeft kwetsbaarheden verholpen in Android.\n\nSamsung heeft de voor Samsung mobile devices relevante kwetsbaarheden verholpen in Samsung Mobile.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, zichzelf verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige code uit te voeren.\n\nOnder de verholpen kwetsbaarheden zit een aantal kwetsbaarheden die door Google worden gemarkeerd als \u0027Critical\u0027.\n\nGoogle heeft verder, zoals gebruikelijk, weinig detailinformatie beschikbaar gesteld.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Google heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Android 12,13 en 14.\n\nSamsung heeft updates uitgebracht om de voor Samsung relevante kwetsbaarheden te verhelpen in Samsung Mobile devices.\n\nZie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
        "title": "CWE-120"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Buffer Over-read",
        "title": "CWE-126"
      },
      {
        "category": "general",
        "text": "Improper Validation of Array Index",
        "title": "CWE-129"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "Improper Privilege Management",
        "title": "CWE-269"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Reachable Assertion",
        "title": "CWE-617"
      },
      {
        "category": "general",
        "text": "Protection Mechanism Failure",
        "title": "CWE-693"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Rendered UI Layers or Frames",
        "title": "CWE-1021"
      },
      {
        "category": "general",
        "text": "Improper Validation of Syntactic Correctness of Input",
        "title": "CWE-1286"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2026\u0026month=6"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://source.android.com/docs/security/bulletin/2026/2026-06-01"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Google Android en Samsung Mobile",
    "tracking": {
      "current_release_date": "2026-06-02T08:00:20.751798Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0173",
      "initial_release_date": "2026-06-02T08:00:20.751798Z",
      "revision_history": [
        {
          "date": "2026-06-02T08:00:20.751798Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Android"
          }
        ],
        "category": "vendor",
        "name": "Google"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Mobile Devices"
          }
        ],
        "category": "vendor",
        "name": "Samsung"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-22424",
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in multiple locations can allow users to access images across accounts, potentially leading to local privilege escalation without additional execution privileges, requiring user interaction for exploitation.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-22424 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22424.json"
        }
      ],
      "title": "CVE-2025-22424"
    },
    {
      "cve": "CVE-2025-22426",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in ComputerEngine.java permits unauthorized access to user URIs, enabling local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-22426 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-22426.json"
        }
      ],
      "title": "CVE-2025-22426"
    },
    {
      "cve": "CVE-2025-32348",
      "notes": [
        {
          "category": "description",
          "text": "A missing permission check in multiple locations allows background activity launches, potentially enabling local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-32348 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-32348.json"
        }
      ],
      "title": "CVE-2025-32348"
    },
    {
      "cve": "CVE-2025-47384",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "category": "other",
          "text": "Reachable Assertion",
          "title": "CWE-617"
        },
        {
          "category": "description",
          "text": "A transient denial of service (DoS) condition arises when the MAC is configured with a configuration ID exceeding its supported maximum value, causing temporary service disruption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47384 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47384.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47384"
    },
    {
      "cve": "CVE-2025-47392",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "Memory corruption occurs during the decoding of corrupted satellite data files containing invalid signature offsets, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47392 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47392.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47392"
    },
    {
      "cve": "CVE-2025-47400",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A cryptographic vulnerability occurs when data is copied to a destination buffer without verifying the buffer\u0027s size, potentially causing security issues such as buffer overflows.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47400 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47400.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47400"
    },
    {
      "cve": "CVE-2025-47401",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A transient denial of service vulnerability occurs during the processing of target power rate tables in channel configuration, potentially disrupting normal device operation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47401 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47401.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47401"
    },
    {
      "cve": "CVE-2025-47403",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "A transient denial-of-service condition may occur during wireless roaming when a malformed Fast Transition response frame with an invalid header structure is processed.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-47403 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-47403.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-47403"
    },
    {
      "cve": "CVE-2025-48570",
      "notes": [
        {
          "category": "description",
          "text": "PipTaskOrganizer.java contains multiple confused deputy vulnerabilities enabling background activity launches that may lead to local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48570 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48570.json"
        }
      ],
      "title": "CVE-2025-48570"
    },
    {
      "cve": "CVE-2025-48595",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability present in multiple locations can enable local privilege escalation without requiring additional execution privileges or user interaction.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48595 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48595.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-48595"
    },
    {
      "cve": "CVE-2025-48615",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "A resource exhaustion issue in getComponentName of MediaButtonReceiverHolder.java may cause desynchronization in persistence, enabling local privilege escalation without user interaction or additional privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48615 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48615.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-48615"
    },
    {
      "cve": "CVE-2025-48649",
      "notes": [
        {
          "category": "description",
          "text": "A permissions bypass vulnerability in multiple locations allows resetting user-selected permissions, potentially enabling local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48649 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48649.json"
        }
      ],
      "title": "CVE-2025-48649"
    },
    {
      "cve": "CVE-2025-48652",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in the performPreInstallChecks function of InstallRepository.kt enables bypassing MDM policy, allowing local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-48652 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-48652.json"
        }
      ],
      "title": "CVE-2025-48652"
    },
    {
      "cve": "CVE-2025-59604",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "Memory corruption arises during a memory copy operation due to invalid writes triggered by a null pointer dereference, leading to potential instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-59604 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-59604.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-59604"
    },
    {
      "cve": "CVE-2025-59605",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities arise from processing device identifier strings that exceed their expected maximum length, potentially leading to unstable system behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-59605 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-59605.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-59605"
    },
    {
      "cve": "CVE-2025-59606",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "description",
          "text": "Memory corruption occurs due to heap memory exhaustion during secure data initialization, leading to writes in invalid memory locations.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-59606 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-59606.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-59606"
    },
    {
      "cve": "CVE-2025-64505",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in libpng, including heap buffer over-reads and overflows in functions like png_do_quantize and png_image_read_composite, affect various products such as MySQL Workbench, NetApp, Oracle Hyperion, and Apple Software, potentially causing data disclosure, denial of service, or application crashes.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64505 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64505.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-64505"
    },
    {
      "cve": "CVE-2025-64720",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "Libpng versions prior to 1.6.51 contain multiple memory handling vulnerabilities including out-of-bounds reads and buffer overflows in functions like png_image_read_composite, png_do_quantize, and png_combine_row, affecting various products such as MySQL Workbench and NetApp devices.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64720 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64720.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-64720"
    },
    {
      "cve": "CVE-2025-65018",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "Multiple heap buffer overflow and out-of-bounds read vulnerabilities exist in libpng versions 1.6.0 to before 1.6.51, affecting functions like png_image_finish_read and png_combine_row, impacting products from Oracle, NetApp, and others.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-65018 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-65018.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2025-65018"
    },
    {
      "cve": "CVE-2026-0009",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in the code enables tapjacking vulnerabilities at multiple points, allowing local privilege escalation without requiring additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0009 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0009.json"
        }
      ],
      "title": "CVE-2026-0009"
    },
    {
      "cve": "CVE-2026-0016",
      "notes": [
        {
          "category": "description",
          "text": "A permissions bypass vulnerability in CredentialManagerService.java\u0027s updateProvidersWhenServiceRemoved function allows overriding settings across users, potentially leading to local information disclosure without extra privileges or user interaction.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0016 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0016.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0016"
    },
    {
      "cve": "CVE-2026-0018",
      "notes": [
        {
          "category": "description",
          "text": "AccessibilityManagerService.java contains multiple functions with inadequate input validation, leading to a persistent local denial of service without requiring user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0018 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0018.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0018"
    },
    {
      "cve": "CVE-2026-0036",
      "notes": [
        {
          "category": "description",
          "text": "A tapjacking vulnerability in the startAnimation method of StageCoordinator.java enables local privilege escalation without requiring user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0036 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0036.json"
        }
      ],
      "title": "CVE-2026-0036"
    },
    {
      "cve": "CVE-2026-0039",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A remote denial of service vulnerability caused by an integer overflow exists in multiple functions of ubsan_throwing_runtime.cpp, exploitable without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0039 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0039.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0039"
    },
    {
      "cve": "CVE-2026-0040",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0040 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0040.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0040"
    },
    {
      "cve": "CVE-2026-0041",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A potential integer overflow in multiple functions of ubsan_throwing_runtime.cpp can cause a UBSan failure, resulting in a remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0041 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0041.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0041"
    },
    {
      "cve": "CVE-2026-0042",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in ubsan_throwing_runtime.cpp functions can lead to a persistent local denial of service via resource exhaustion without requiring user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0042 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0042.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0042"
    },
    {
      "cve": "CVE-2026-0043",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A vulnerability in ubsan_throwing_runtime.cpp involving integer overflow can lead to persistent denial of service and local privilege escalation without requiring user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0043 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0043.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0043"
    },
    {
      "cve": "CVE-2026-0044",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "A vulnerability in ubsan_throwing_runtime.cpp involving an integer overflow can cause a system crash, potentially enabling remote denial of service without user interaction or additional privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0044 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0044.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0044"
    },
    {
      "cve": "CVE-2026-0046",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in InputInterceptor of Letterbox.java enables a tapjacking/overlay attack that can trick users into granting permissions, potentially causing local privilege escalation without user interaction or extra execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0046 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0046.json"
        }
      ],
      "title": "CVE-2026-0046"
    },
    {
      "cve": "CVE-2026-0048",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in WindowState.java enables a tapjacking or overlay attack that can deceive users into granting permissions, potentially resulting in local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0048 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0048.json"
        }
      ],
      "title": "CVE-2026-0048"
    },
    {
      "cve": "CVE-2026-0051",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in multiple functions of ubsan_throwing_runtime.cpp allows remote denial of service via improper input validation, exploitable without user interaction or additional privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0051 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0051.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0051"
    },
    {
      "cve": "CVE-2026-0052",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0052 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0052.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0052"
    },
    {
      "cve": "CVE-2026-0055",
      "notes": [
        {
          "category": "description",
          "text": "A path traversal vulnerability in PackageInstallerService.java\u0027s createSessionInternal method allows local privilege escalation by enabling updates to a Device Policy Controller in unauthorized directories without user interaction or extra privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0055 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0055.json"
        }
      ],
      "title": "CVE-2026-0055"
    },
    {
      "cve": "CVE-2026-0056",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "A vulnerability in ResourceTypes.cpp\u0027s setTo function may lead to an out-of-bounds read, potentially causing local information disclosure without user interaction or elevated privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0056 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0056.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0056"
    },
    {
      "cve": "CVE-2026-0059",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in multiple functions of sdp_discovery.cc could enable remote code execution without requiring additional privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0059 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0059.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0059"
    },
    {
      "cve": "CVE-2026-0061",
      "notes": [
        {
          "category": "description",
          "text": "WindowState.java contains multiple functions vulnerable to tapjacking and overlay attacks that can deceive users into granting permissions, enabling local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0061 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0061.json"
        }
      ],
      "title": "CVE-2026-0061"
    },
    {
      "cve": "CVE-2026-0069",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in the verifySignature function of ApkChecksums.java can cause resource exhaustion leading to a crash and local denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0069 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0069.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0069"
    },
    {
      "cve": "CVE-2026-0070",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in DevicePolicyManagerService.java allows hiding a critical system package via improper input validation, enabling a local denial of service without user interaction or additional privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0070 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0070.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0070"
    },
    {
      "cve": "CVE-2026-0076",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability in the validateNode function of ResourceTypes.cpp due to improper bounds checking may enable local privilege escalation without additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0076 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0076.json"
        }
      ],
      "title": "CVE-2026-0076"
    },
    {
      "cve": "CVE-2026-0077",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in resumeConfigurationDispatch within ActivityRecord.java can trigger background application launches, enabling local privilege escalation without user interaction or elevated execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0077 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0077.json"
        }
      ],
      "title": "CVE-2026-0077"
    },
    {
      "cve": "CVE-2026-0078",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in DevicePolicyManagerService.java\u0027s setGlobalProxy method allows local privilege escalation without user interaction due to improper input validation causing persistence desynchronization.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0078 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0078.json"
        }
      ],
      "title": "CVE-2026-0078"
    },
    {
      "cve": "CVE-2026-0080",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "An integer overflow vulnerability in multiple functions of ubsan_throwing_runtime.cpp can cause a crash, resulting in remote denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0080 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0080.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0080"
    },
    {
      "cve": "CVE-2026-0087",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in DomainVerificationService.java\u0027s approvalLevelForDomainInternal function enables hijacking of arbitrary app links, leading to local privilege escalation without user interaction or extra execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0087 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0087.json"
        }
      ],
      "title": "CVE-2026-0087"
    },
    {
      "cve": "CVE-2026-0089",
      "notes": [
        {
          "category": "description",
          "text": "A missing permission check in multiple functions of PackageInstallerService.java enables installation of unverified applications, potentially causing local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0089 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0089.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0089"
    },
    {
      "cve": "CVE-2026-0091",
      "notes": [
        {
          "category": "description",
          "text": "An over-privileged shell user in the launcher process enables code execution that results in local privilege escalation without requiring user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0091 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0091.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0091"
    },
    {
      "cve": "CVE-2026-0097",
      "notes": [
        {
          "category": "description",
          "text": "A logic error in multiple locations allows bypassing user interaction during LE device pairing, enabling remote privilege escalation without requiring additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0097 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0097.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0097"
    },
    {
      "cve": "CVE-2026-0100",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability in LoadedArsc.cpp can lead to an out-of-bounds write, enabling local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-0100 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0100.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-0100"
    },
    {
      "cve": "CVE-2026-21017",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in SecTelephonyProvider before SMR Jun-2026 Release 1 allows local attackers to access privileged files due to improper privilege handling.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21017 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21017.json"
        }
      ],
      "title": "CVE-2026-21017"
    },
    {
      "cve": "CVE-2026-21025",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Telephony before SMR Jun-2026 Release 1 allows local attackers to access sensitive information due to incorrect privilege assignment, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21025 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21025.json"
        }
      ],
      "title": "CVE-2026-21025"
    },
    {
      "cve": "CVE-2026-21026",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in SpriteWallpaper before SMR Jun-2026 Release 1 allows local attackers to access sensitive information due to improper export of Android application components.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21026 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21026.json"
        }
      ],
      "title": "CVE-2026-21026"
    },
    {
      "cve": "CVE-2026-21027",
      "notes": [
        {
          "category": "description",
          "text": "An improper export vulnerability in Android\u0027s ImsSettings component before SMR June 2026 Release 1 allows local attackers to trigger the logging function.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21027 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21027.json"
        }
      ],
      "title": "CVE-2026-21027"
    },
    {
      "cve": "CVE-2026-21028",
      "notes": [
        {
          "category": "description",
          "text": "An improper access control vulnerability in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21028 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21028.json"
        }
      ],
      "title": "CVE-2026-21028"
    },
    {
      "cve": "CVE-2026-21029",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Galaxy Editing Service before SMR Jun-2026 Release 1 allows local attackers to perform privileged operations by exploiting improper export of Android application components.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21029 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21029.json"
        }
      ],
      "title": "CVE-2026-21029"
    },
    {
      "cve": "CVE-2026-21030",
      "notes": [
        {
          "category": "description",
          "text": "An improper access control vulnerability in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to execute privileged functions, posing a significant security risk.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21030 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21030.json"
        }
      ],
      "title": "CVE-2026-21030"
    },
    {
      "cve": "CVE-2026-21031",
      "notes": [
        {
          "category": "description",
          "text": "An improper authorization vulnerability in AppBlock before SMR Jun-2026 Release 1 allows a local attacker to launch arbitrary activities, requiring user interaction to exploit.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21031 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21031.json"
        }
      ],
      "title": "CVE-2026-21031"
    },
    {
      "cve": "CVE-2026-21352",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "description",
          "text": "DNG SDK versions 1.7.1 2410 and earlier have an out-of-bounds write vulnerability that may allow arbitrary code execution when processing malicious files.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21352 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21352.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21352"
    },
    {
      "cve": "CVE-2026-21353",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "DNG SDK versions 1.7.1 2410 and earlier contain an Integer Overflow vulnerability that allows arbitrary code execution when a malicious file is opened.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21353 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21353.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21353"
    },
    {
      "cve": "CVE-2026-21367",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A transient denial of service vulnerability arises from processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial network scans, potentially disrupting normal device operations.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21367 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21367.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21367"
    },
    {
      "cve": "CVE-2026-21372",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities arise from sending IOCTL requests with invalid buffer sizes during memcpy operations, potentially leading to unstable system behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21372 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21372.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21372"
    },
    {
      "cve": "CVE-2026-21373",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities can arise when output buffer sizes are not properly validated during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21373 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21373.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21373"
    },
    {
      "cve": "CVE-2026-21374",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability arises from insufficient buffer size validation during the processing of auxiliary sensor input/output control commands, potentially leading to unstable system behavior.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21374 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21374.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21374"
    },
    {
      "cve": "CVE-2026-21375",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities can arise when output buffer sizes are not properly validated during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21375 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21375.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21375"
    },
    {
      "cve": "CVE-2026-21376",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability exists in a camera sensor driver caused by insufficient validation of output buffer size during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21376 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21376.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21376"
    },
    {
      "cve": "CVE-2026-21378",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability exists in a camera sensor driver caused by insufficient validation of output buffer size during IOCTL processing, potentially leading to system instability or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21378 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21378.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21378"
    },
    {
      "cve": "CVE-2026-21380",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerabilities arise from the use of deprecated DMABUF IOCTL calls for video memory management, potentially impacting system stability and security.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21380 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21380.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21380"
    },
    {
      "cve": "CVE-2026-21381",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Over-read",
          "title": "CWE-126"
        },
        {
          "category": "description",
          "text": "A transient denial-of-service vulnerability arises when a device processes a service data frame with excessive length during device matching over a Neighborhood Awareness Network protocol connection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21381 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21381.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-21381"
    },
    {
      "cve": "CVE-2026-21547",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21547 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21547.json"
        }
      ],
      "title": "CVE-2026-21547"
    },
    {
      "cve": "CVE-2026-23787",
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-23787 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-23787.json"
        }
      ],
      "title": "CVE-2026-23787"
    },
    {
      "cve": "CVE-2026-24085",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        },
        {
          "category": "description",
          "text": "Memory corruption arises during the processing of display command line information due to an uninitialized variable, potentially leading to unstable system behavior or security risks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-24085 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24085.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-24085"
    },
    {
      "cve": "CVE-2026-24089",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Syntactic Correctness of Input",
          "title": "CWE-1286"
        },
        {
          "category": "description",
          "text": "Memory corruption vulnerability arises from processing fastboot commands with invalid input, potentially leading to unstable system behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-24089 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24089.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-24089"
    },
    {
      "cve": "CVE-2026-25276",
      "cwe": {
        "id": "CWE-129",
        "name": "Improper Validation of Array Index"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Array Index",
          "title": "CWE-129"
        },
        {
          "category": "description",
          "text": "A memory corruption vulnerability arises in Strongbox due to the absence of a bounds check, potentially leading to unstable behavior or exploitation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-25276 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25276.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-25276"
    },
    {
      "cve": "CVE-2026-25277",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "A buffer overflow vulnerability in Strongbox leads to memory corruption, potentially compromising system stability and security.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-25277 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25277.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-25277"
    },
    {
      "cve": "CVE-2026-28577",
      "cwe": {
        "id": "CWE-1021",
        "name": "Improper Restriction of Rendered UI Layers or Frames"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of Rendered UI Layers or Frames",
          "title": "CWE-1021"
        },
        {
          "category": "description",
          "text": "A tapjacking vulnerability in the addWindow method of WindowManagerService.java enables local privilege escalation without user interaction or additional execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28577 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28577.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28577"
    },
    {
      "cve": "CVE-2026-28578",
      "notes": [
        {
          "category": "description",
          "text": "DevicePolicyManagerService.java contains multiple functions with improper input validation that can cause desynchronization from persistence, potentially resulting in a local denial of service without user interaction or elevated privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28578 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28578.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28578"
    },
    {
      "cve": "CVE-2026-28580",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
          "title": "CWE-120"
        },
        {
          "category": "description",
          "text": "A bounds check error in multiple functions can cause persistence desynchronization, leading to local privilege escalation without requiring additional execution privileges or user interaction.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28580 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28580.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28580"
    },
    {
      "cve": "CVE-2026-28586",
      "notes": [
        {
          "category": "description",
          "text": "AppOpsService.java contains multiple functions lacking proper permission checks, potentially enabling local information disclosure without user interaction or elevated execution privileges.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28586 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28586.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28586"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.