PT-2025-50708 · Tachyon · Tachyon

Published 2025-12-11 · Updated 2025-12-13 · CVE-2025-36927

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tachyon (affected versions not specified)

Description The software contains a potential out-of-bounds write issue within the GetTachyonCommand function in tachyon server common.h. This condition could allow for local privilege escalation without requiring additional execution privileges or user interaction. The issue stems from a missing bounds check during the process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

CVE-2025-36927

Affected Products

Tachyon

References · 3

• https://source.android.com/security/bulletin/pixel/2025-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36927 · Security Note
• https://twitter.com/CVEnew/status/1999876867407397038 · Twitter Post