CVE-2025-32312: Android Framework PackageParser Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2025-32312: In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-06-01
>= 14:0, < 14:2025-06-01
>= 15:0, < 15:2025-06-01
>= 16-next:0, < 16-next:2025-06-01
Fixed in 16-next:2025-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Framework's PackageParser is a core component responsible for parsing and managing application packages. It plays a crucial role in the installation and management of apps on Android devices. This package is integral to the Android ecosystem, ensuring that applications are correctly interpreted and executed. However, it has been found to be vulnerable to unsafe deserialization, which can lead to significant security risks.
Vulnerability Detail
In the createIntentsList function of PackageParser.java, there exists a flaw that allows for the bypassing of lazy bundle hardening. This vulnerability enables modified data to be passed to subsequent processes without proper validation, leading to potential local escalation of privileges. The exploitation of this vulnerability does not require additional execution privileges or user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
16-next:2025-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is strongly recommended to apply the patch as soon as it becomes available.
Conclusion
The vulnerability identified as CVE-2025-32312 in the Android Framework's PackageParser poses a serious risk of local privilege escalation due to unsafe deserialization. Users are urged to update their packages to the latest patched versions to safeguard their applications.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-32312 is a vulnerability in the Android Framework's PackageParser that allows for local privilege escalation due to unsafe deserialization.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which requires no signup.
The primary risk is local privilege escalation, which could allow an attacker to gain unauthorized access to sensitive data or functionalities within the application.
No, user interaction is not needed for exploitation, making it a significant security concern.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
