CVE-2020-0424

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In send_vc of res_send.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-161362564

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Nov 10, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-04255.5There is a possible way to view notifications even when the "Lockdown" feature is on. This could lead to local information disclosure with nCVE-2020-04265.5In SyncManager, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with nCVE-2020-04275.5In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosureCVE-2020-04286.4In CamX code, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execuCVE-2020-04296.7In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead toCVE-2020-04307.8In skb_headlen of /include/linux/skbuff.h, there is a possible out of bounds read due to memory corruption. This could lead to local escalatCVE-2020-04316.7In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of CVE-2020-04327.8In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of CVE-2020-04337.8In blk_mq_queue_tag_busy_iter of blk-mq-tag.c, there is a possible use after free due to improper locking. This could lead to local escalatiCVE-2020-04347.8In Pixel's use of the Catpipe library, there is possible memory corruption due to a use after free. This could lead to local escalation of pCVE-2020-04375.5In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check. This could lead to locaCVE-2020-04387.8In the AIBinder_Class constructor of ibinder.cpp, there is a possible arbitrary code execution due to uninitialized data. This could lead to
CVE-2020-0424: Medium severity, CVSS 5.5 | Vulnix