CVE-2026-0145Medium· 4.0▾ SunlitIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.07%
0.07% → 0.08%
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
androidRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-20572Medium· 6.7In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check
CVE-2026-0142Medium· 4.0In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation
CVE-2026-0134Medium· 4.0In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code
CVE-2025-48617High· 7.8In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass
CVE-2025-48640High· 8.0In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check
CVE-2025-48614Medium· 4.6In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check