CVE-2023-20954

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261867748

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-209557.8In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and uninstall applications fo CVE-2023-209564.4In Import of C2SurfaceSyncObj.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local informati CVE-2023-209577.8In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confused deputy. This could CVE-2023-209587.1In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local information disclo CVE-2023-209597.8In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead to CVE-2023-20969.8A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknow CVE-2023-209608.8In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities due to improper inpu CVE-2023-209625.5In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to CVE-2023-209637.8In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges CVE-2023-209647.8In multiple functions of MediaSessionRecord.java, there is a possible Intent rebroadcast due to a confused deputy. This could lead to local CVE-2023-209659.8In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. T CVE-2023-209667.8In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privi