PT-2025-24447 · Google · Android

Published 2025-05-01 · Updated 2025-09-05 · CVE-2025-26421

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A logic error in the code may allow a lock screen bypass, potentially leading to local privilege escalation without requiring additional execution privileges or user interaction. The vulnerability resides within the System component of the Android operating system and involves improper code generation management, which could allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-94

CWE-290

Related Identifiers

ASB-A-344865740

BDU:2025-06585

CVE-2025-26421

Affected Products

Android

References · 10

• https://android.googlesource.com/platform/frameworks/base/+/b66817d2ed3b6ef29873bfe9857081cdef63681f · Patch
• https://source.android.com/security/bulletin/2025-05-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26421 · Security Note
• https://bdu.fstec.ru/vul/2025-06585 · Security Note
• https://android.googlesource.com/platform/packages/apps/Settings/+/f16fa58405ed94703ea1886c483a2e2ce1c2b176 · Patch
• https://osv.dev/vulnerability/CVE-2025-26421 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-344865740 · Vendor Advisory
• https://twitter.com/CVEnew/status/1963655979582497243 · Twitter Post
• https://source.android.com/docs/security/bulletin/2025-05-01?hl=en · Note
• https://t.me/cveNotify/134487 · Telegram Post