PT-2025-20288 · Google · Android

Published 2025-05-01 · Updated 2025-09-05 · CVE-2025-26426

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Framework component of the Android operating system related to a buffer copy without proper input validation. This issue may allow an attacker to escalate privileges locally without requiring additional execution privileges or user interaction. The vulnerability resides within the registerReceiverWithFeatureTraced function in BroadcastController.java and involves receiving broadcasts intended for the “android” package.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-120

Related Identifiers

ASB-A-310632322

BDU:2025-06588

CVE-2025-26426

Affected Products

Android

References · 12

• https://osv.dev/vulnerability/CVE-2025-26426 · Vendor Advisory
• https://source.android.com/security/bulletin/2025-05-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26426 · Security Note
• https://bdu.fstec.ru/vul/2025-06588 · Security Note
• https://osv.dev/vulnerability/ASB-A-310632322 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/475f9914f71641f0eedc4a8412cf48f49290a60c · Note
• https://t.me/aptreports/18350 · Telegram Post
• https://source.android.com/docs/security/bulletin/2025-05-01?hl=en · Note
• https://t.me/aptreports/18352 · Telegram Post
• https://twitter.com/CVEnew/status/1963655974100562069 · Twitter Post
• https://android.googlesource.com/platform/frameworks/base/+/99aae825ded253fe58695ceb853f2f631137f1c4 · Note
• https://t.me/cveNotify/134497 · Telegram Post