CVE-2025-32313: Android Frameworks Base and Native - Out of Bounds Write Vulnerability
Summary
CVE-2025-32313: In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. Affects platform/frameworks/base across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Frameworks Base and Native packages are essential components of the Android operating system, providing core functionalities and services. These packages handle various system-level operations, including app notifications and inter-process communication. The vulnerability in question arises from improper bounds checking in the UsageEvents class, potentially allowing unauthorized access to system resources.
Vulnerability Detail
The vulnerability identified as CVE-2025-32313 is an out of bounds write issue in the UsageEvents.java file of the Android Frameworks Base package. This flaw is caused by an incorrect bounds check, which can lead to local escalation of privilege without requiring additional execution privileges. The implications of this vulnerability are significant, as it could allow malicious applications to manipulate system resources or data, potentially compromising the integrity and security of the device.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the permissions of applications that utilize the affected components until the patch is applied. This can be done by navigating to the app settings and disabling permissions that are not essential for the app's functionality.
Conclusion
In summary, CVE-2025-32313 presents a serious security risk in the Android Frameworks Base and Native packages due to an out of bounds write vulnerability. It is crucial for developers and users to apply the necessary updates to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-32313 is a vulnerability in the Android Frameworks Base and Native packages that allows for an out of bounds write due to improper bounds checking.
The vulnerability could lead to local escalation of privilege, allowing malicious applications to access or manipulate system resources without proper authorization.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the affected packages to the patched versions as specified in the 'how to fix' section. Additionally, consider restricting app permissions as a temporary measure.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the gradle.lockfile, ensuring your application remains secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
