CVE-2025-32337: Heap Buffer Overflow in Android Package Leading to Remote Privilege Escalation
Summary
CVE-2025-32337: In sms_SetTpUdIe() of sms_PduCodec.cc, there is a possible out of bounds write due to a heap buffer overflow. Affects :unknown: versions >= :0, < :2025-06-05. Fixed in :2025-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically within the sms_PduCodec.cc file. This package is responsible for handling Short Message Service (SMS) protocols, which are crucial for mobile communication. Given the widespread use of SMS for both personal and business communication, vulnerabilities in this package can have significant implications for user security and privacy.
Vulnerability Detail
In the function sms_SetTpUdIe() of sms_PduCodec.cc, a heap buffer overflow occurs, which can lead to an out-of-bounds write. This vulnerability allows an attacker to escalate privileges remotely without requiring any additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
:2025-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-32337 represents a critical vulnerability in the Android ecosystem that could allow for remote privilege escalation due to a heap buffer overflow. Users are strongly encouraged to update their devices to the patched version as soon as it becomes available to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-32337 is a vulnerability in the Android ecosystem that allows for remote privilege escalation due to a heap buffer overflow in the sms_PduCodec.cc file.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
While there are no specific workarounds available, it is crucial to apply the patch as soon as possible to mitigate the risk associated with this vulnerability.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
The vulnerability could lead to remote escalation of privileges, allowing attackers to gain unauthorized access to sensitive information or control over the affected device.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
