CVE-2025-36900: Android Package Vulnerability Leading to Local Privilege Escalation
Summary
CVE-2025-36900: In lwis_test_register_io of lwis_device_test.c, there is a possible OOB Write due to an integer overflow. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-09-05. Fixed in Pixel-family specific:2025-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically related to the Pixel family of devices. This package is responsible for handling low-level interactions with hardware components, ensuring that device functionalities operate smoothly. However, it has been identified that this package is vulnerable to an out-of-bounds (OOB) write due to an integer overflow, which can potentially compromise system security.
Vulnerability Detail
The vulnerability arises in the function lwis_test_register_io within lwis_device_test.c, where an integer overflow can lead to an out-of-bounds write. This flaw allows for local escalation of privileges, meaning that an attacker could gain elevated system execution privileges without requiring user interaction. The severity of this vulnerability is classified as moderate, and it poses a significant risk to the integrity of the system.
How To Fix
Minimum fixed version
Pixel-family specific:2025-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
In summary, CVE-2025-36900 represents a moderate risk vulnerability in the Android ecosystem that could lead to local privilege escalation. Users are strongly advised to update their devices to the latest patched version to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36900 is a vulnerability in the Android ecosystem that allows for local privilege escalation due to an out-of-bounds write caused by an integer overflow.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring access to the code.
If your device is vulnerable, you should update to the patched version released on September 5, 2025, to mitigate the risk.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
The potential consequences include unauthorized access to system-level privileges, which could allow an attacker to manipulate system functions or access sensitive data.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
