CVE-2025-32329: Android Frameworks Base Package Local Privilege Escalation Vulnerability
Summary
CVE-2025-32329: In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Affects platform/frameworks/base across 4 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It facilitates interactions between the hardware and software layers, enabling developers to create robust applications. This package is critical for managing user sessions, UI components, and system services. However, it is susceptible to vulnerabilities that can lead to unauthorized access or privilege escalation, compromising user data and system integrity.
Vulnerability Detail
In multiple functions of Session.java, a logic error allows unauthorized access to images belonging to different users on the device. This vulnerability can lead to local privilege escalation without requiring additional execution privileges or user interaction. The flaw arises from improper handling of user session data, which can be exploited to access sensitive information, potentially leading to data leaks and privacy violations.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to sensitive images by adjusting application permissions and ensuring that user sessions are properly isolated. Additionally, developers should implement checks to validate user access rights before displaying any user-specific data.
Conclusion
The CVE-2025-32329 vulnerability in the Android Frameworks Base package poses significant risks related to unauthorized access and privilege escalation. It is crucial for developers to apply the available patch and implement best practices for user data protection to safeguard against potential exploitation.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-32329 is a vulnerability in the Android Frameworks Base package that allows unauthorized access to images belonging to different users due to a logic error.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive user data, potential data leaks, and privacy violations, which can compromise user trust and application integrity.
Yes, a patch is available. Update the Android Frameworks Base package to the fixed version released on 2025-12-01.
If you cannot apply the patch immediately, consider implementing access controls and validating user permissions to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
