CVE-2025-36887: Android Pixel-family Specific Out of Bounds Write Vulnerability
Summary
CVE-2025-36887: In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-06-05. Fixed in Pixel-family specific:2025-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vulnerability affects the wl_cfgscan component of the Android operating system, specifically in the Pixel-family devices. This component is responsible for managing Wi-Fi scanning configurations and results. The vulnerability arises from an incorrect bounds check in the wl_cfgscan_update_v3_schedscan_results() function, which can lead to potential security risks.
Vulnerability Detail
In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation, making it a significant security concern for affected devices.
How To Fix
Minimum fixed version
Pixel-family specific:2025-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as it is released.
Conclusion
CVE-2025-36887 is a significant vulnerability affecting Android Pixel-family devices, allowing for local privilege escalation due to an out of bounds write. Users are advised to update their devices promptly to the patched version to ensure their security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36887 is a vulnerability in the Android operating system that allows for an out of bounds write, potentially leading to local privilege escalation.
The vulnerability specifically affects Pixel-family devices running the vulnerable version of the Android operating system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If your device is vulnerable, you should update it to the patched version available after June 5, 2025, to mitigate the risk.
No, user interaction is not needed for exploitation, which increases the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
