CVE-2025-26460: Android Pixel-family Common Utils Out of Bounds Write Vulnerability
Summary
CVE-2025-26460: In CopyDataFromFmq of common_utils.cpp, there is a possible out of bounds write due to a missing bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-06-05. Fixed in Pixel-family specific:2025-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically targeting Pixel-family devices. This package includes common utilities that facilitate various operations within the Android operating system. It is crucial for maintaining system stability and performance, but it has a vulnerability that could potentially allow unauthorized privilege escalation.
Vulnerability Detail
In the CopyDataFromFmq function of common_utils.cpp, there exists a potential out of bounds write due to a missing bounds check. This vulnerability can lead to local escalation of privileges without requiring additional execution privileges. Exploitation does not necessitate user interaction, making it a significant security concern for affected devices.
How To Fix
Minimum fixed version
Pixel-family specific:2025-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate risks.
Conclusion
The CVE-2025-26460 vulnerability presents a serious risk for Android Pixel-family devices due to an out of bounds write issue in the common_utils.cpp file. Users are strongly encouraged to update their devices to the patched version to mitigate this risk.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-26460 is a vulnerability in the Android Pixel-family's common_utils.cpp that allows for potential out of bounds writes, leading to local privilege escalation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
While there are no specific workarounds available, it is recommended to monitor your device for updates and apply the patch as soon as it is available.
No, user interaction is not needed for exploitation, which makes this vulnerability particularly concerning.
The vulnerability could allow an attacker to escalate privileges locally, potentially leading to unauthorized access to sensitive system functions.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
