PT-2025-36045 · Unknown · Voicemailsettingsactivity.Java

Published 2025-09-01 · Updated 2025-09-05 · CVE-2025-32346

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VoicemailSettingsActivity.java (affected versions not specified)

Description A potential work profile contact number leak exists due to a confused deputy condition within the onActivityResult function of the VoicemailSettingsActivity.java file. This issue could lead to local escalation of privilege without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-441

Related Identifiers

ASB-A-337785563

BDU:2025-11576

CVE-2025-32346

Affected Products

Voicemailsettingsactivity.Java

References · 8

• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32346 · Security Note
• https://osv.dev/vulnerability/ASB-A-337785563 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11576 · Security Note
• https://twitter.com/CVEnew/status/1963827295501848576 · Twitter Post
• https://android.googlesource.com/platform/packages/services/Telephony/+/ccfb4f0691ca97be5b5593e65bd26e843641f929 · Note
• https://android.googlesource.com/platform/packages/services/Telephony/+/76467ce5606ca15a23125e1979ada74ba843cd6a · Note