CVE-2021-39806

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In closef of label_backends_android.c, there is a possible way to corrupt memory due to a double free. This could lead to local escalation of privilege during startup of servicemanager, if an attacker can trigger an initialization failure, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-215387420

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-398077.8In handleNfcStateChanged of SecureNfcEnabler.java, there is a possible way to enable NFC from the Guest account due to a missing permission CVE-2021-398087.8In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notificCVE-2021-398097.5In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to reCVE-2021-39813.3A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non priviCVE-2021-398107.8In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app withCVE-2021-398127.8In TBD of TBD, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with no addiCVE-2021-398146.7In ppmp_validate_wsm of drm_fw.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalatCVE-2021-398159.8The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue usCVE-2021-398167.8Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge fileCVE-2021-398177.8Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge fileCVE-2021-398187.8Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, CVE-2021-398197.8Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious XML file, p