PT-2025-36035 · Unknown · Shared.Java

Published 2025-09-01 · Updated 2025-09-05 · CVE-2025-32323

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shared.java (affected versions not specified)

Description The getCallingAppName function in Shared.java may allow an attacker to trick users into granting file access through deceptive text displayed in a permission popup. This is due to improper input validation. Successful exploitation could lead to local escalation of privilege without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ASB-A-397216537

BDU:2025-11555

CVE-2025-32323

Affected Products

Shared.Java

References · 9

• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/f0336ada165fdda955eaf6245b501779f36f0bd3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-32323 · Security Note
• https://osv.dev/vulnerability/ASB-A-397216537 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32323 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11555 · Security Note
• https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/a74695f75d269a0caf2885d52833489eb97e2f72 · Note
• https://twitter.com/CVEnew/status/1963827305937301667 · Twitter Post
• https://android.googlesource.com/platform/packages/apps/DocumentsUI/+/35a75b2455084a2c77663682780d7b64fb60c161 · Note