CVE-2025-36937
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-15
Assigner: Google Devices
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| android | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out of bounds write in the AudioDecoder::HandleProduceRequest function of audio_decoder.cc caused by an incorrect bounds check. This flaw allows writing data outside the intended memory boundaries.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to remote code execution without requiring any additional execution privileges or user interaction, potentially allowing an attacker to take control of the affected system remotely.
What immediate steps should I take to mitigate this vulnerability?
Users should update their devices to the latest security patch level, specifically the 2025-12-05 patch level or later, which includes fixes for related vulnerabilities in Pixel firmware. Applying the latest firmware updates from the Google Developer site is recommended to mitigate this and other security issues. [1]