PT-2025-24446 · Google · Android

Published 2025-05-01 · Updated 2025-09-05 · CVE-2025-26422

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Android operating system's Framework component related to a buffer copy operation lacking input size validation. Exploitation of this issue may allow an attacker to escalate privileges. Additionally, a potential issue exists in WindowManagerService.java where dumpsys can be executed without the necessary permissions, potentially leading to local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-279

CWE-120

Related Identifiers

ASB-A-383328827

BDU:2025-06584

CVE-2025-26422

Affected Products

Android

References · 9

• https://source.android.com/security/bulletin/2025-05-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-26422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26422 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/63ae789499395abc2b71fd46f57cac3c4ba1bd9d · Patch
• https://bdu.fstec.ru/vul/2025-06584 · Security Note
• https://osv.dev/vulnerability/ASB-A-383328827 · Vendor Advisory
• https://t.me/cveNotify/134488 · Telegram Post
• https://source.android.com/docs/security/bulletin/2025-05-01?hl=en · Note
• https://twitter.com/CVEnew/status/1963655978563289296 · Twitter Post