CVE-2023-21168

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-253270285

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
n/aAndroidAndroid-13

References

Timeline

Published
Jun 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-211694.4In inviteInternal of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local informatiCVE-2023-21172.7The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, aCVE-2023-211704.4In executeSetClientTarget of ComposerCommandEngine.h, there is a possible out of bounds read due to a missing bounds check. This could lead CVE-2023-211716.7In verifyInputEvent of InputDispatcher.cpp, there is a possible way to conduct click fraud due to side channel information disclosure. This CVE-2023-211727.8In multiple functions of WifiCallingSettings.java, there is a possible way to change calling preferences for the admin user due to a permissCVE-2023-211735.5In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permissioCVE-2023-211747.8In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits due to a permissions bCVE-2023-211757.8In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypaCVE-2023-211764.4In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local deCVE-2023-211775.5In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interacting with due to a miCVE-2023-211784.1In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to local information dCVE-2023-211797.8In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used
CVE-2023-21168: Medium severity, CVSS 5.5 | Vulnix