CVE-2021-39808

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In createNotificationChannelGroup of PreferencesHelper.java, there is a possible way for a service to run in foreground without user notification due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-209966086

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-398097.5In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to re CVE-2021-39813.3A flaw in grub2 was found where its configuration file, known as grub.cfg, is being created with the wrong permission set allowing non privi CVE-2021-398107.8In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app with CVE-2021-398127.8In TBD of TBD, there is a possible out of bounds read due to a use after free. This could lead to local escalation of privilege with no addi CVE-2021-398146.7In ppmp_validate_wsm of drm_fw.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalat CVE-2021-398159.8The PowerVR GPU driver allows unprivileged apps to allocated pinned memory, unpin it (which makes it available to be freed), and continue us CVE-2021-398167.8Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file CVE-2021-398177.8Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious Bridge file CVE-2021-398187.8Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious TIFF file, CVE-2021-398197.8Adobe InCopy version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious XML file, p CVE-2021-39825.5Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with low privilege permi CVE-2021-398207.8Adobe InDesign versions 16.3 (and earlier), and 16.3.1 (and earlier) is affected by an Out-of-bounds Write vulnerability due to insecure han