BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-15

Assigner: Google Devices

Description

In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-11

Last Modified

2025-12-15

Generated

2026-07-06

AI Q&A

2025-12-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-36935

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Mitigation Strategies

Apply the latest security patches provided by Google for Pixel devices, specifically the December 2025 security patch or later, as these updates include fixes for vulnerabilities including CVE-2025-36935. [1]

Executive Summary

This vulnerability is a possible memory corruption in the function trusty_ffa_mem_reclaim within shared-mem-smcall.c caused by uninitialized data. It can be exploited locally without needing additional execution privileges or user interaction.

Impact Analysis

The vulnerability could lead to local escalation of privilege, allowing an attacker with local access to gain higher privileges on the affected system.

Hi! I’m here to help you understand CVE-2025-36935. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70