CVE-2025-32340: Android Pixel-family ProtocolMiscCurrentLinkCapacityEstimate Out of Bounds Read Vulnerability
Summary
CVE-2025-32340: In ProtocolMiscCurrentLinkCapacityEstimate() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a heap buffer overflow. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-06-05. Fixed in Pixel-family specific:2025-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically targeting Pixel-family devices. This package is responsible for managing various protocol-related functionalities, including link capacity estimates. Its critical role in network management makes it essential for maintaining optimal device performance and connectivity. However, the presence of vulnerabilities can compromise the integrity and security of the device.
Vulnerability Detail
In the function ProtocolMiscCurrentLinkCapacityEstimate() located in protocolmiscadapter.cpp, a potential out of bounds read vulnerability arises due to a heap buffer overflow. This flaw can lead to local information disclosure without requiring additional execution privileges. The vulnerability is particularly concerning as it does not necessitate user interaction for exploitation, making it a silent threat that could expose sensitive data.
How To Fix
Minimum fixed version
Pixel-family specific:2025-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-32340 vulnerability presents a significant risk to Android Pixel-family devices due to its potential for local information disclosure. Users are strongly encouraged to update their devices to the patched version released on June 5, 2025, to protect against this threat.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-32340 is a vulnerability in the Android Pixel-family devices that allows for a potential out of bounds read due to a heap buffer overflow.
This vulnerability can lead to local information disclosure, potentially exposing sensitive data without requiring user interaction.
If you are using a Pixel-family device with the affected version of the software, you are at risk until the patch is applied.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
