CVE-2025-32328: Android Frameworks Base Package Local Privilege Escalation Vulnerability
Summary
CVE-2025-32328: In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16-next:0, < 16-next:2025-12-01
Fixed in 16-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It facilitates interactions between the hardware and software layers of Android devices, enabling functionalities such as user interface management, system services, and application lifecycle management. This package is critical for the overall performance and security of Android devices. However, it is susceptible to vulnerabilities that can lead to unauthorized access and privilege escalation.
Vulnerability Detail
In multiple functions of Session.java, a logic error allows unauthorized access to images belonging to different users on the device. This vulnerability can lead to local privilege escalation without requiring additional execution privileges or user interaction. The flaw arises from improper handling of user sessions, which can be exploited to access sensitive data, potentially compromising user privacy and security.
How To Fix
Minimum fixed version
16-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to sensitive data by adjusting application permissions and ensuring that user sessions are properly managed. However, this is not a complete fix and should not replace applying the official patch.
Conclusion
The CVE-2025-32328 vulnerability in the Android Frameworks Base package poses a serious risk of local privilege escalation, allowing unauthorized access to user images. It is crucial to apply the available patch to mitigate this risk and ensure the security of user data.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-32328 is a vulnerability in the Android Frameworks Base package that allows unauthorized access to user images due to a logic error in the code.
This vulnerability can lead to local privilege escalation, allowing unauthorized users to access sensitive images belonging to other users on the device.
No, user interaction is not needed for exploitation, making it a significant security concern.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider implementing temporary workarounds such as adjusting permissions and managing user sessions carefully.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
