CVE-2025-36907: Android Package Vulnerability Leading to Local Privilege Escalation via Heap Buffer Overflow
Summary
CVE-2025-36907: In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-09-05. Fixed in Pixel-family specific:2025-09-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android operating system is a widely used open-source platform that powers a variety of devices, including smartphones and tablets. It provides a rich application framework that allows developers to build innovative apps. However, like any software, it is susceptible to vulnerabilities. This specific vulnerability affects the draw_surface_image() function in the Android library, which is responsible for rendering images on the screen. The vulnerability arises from a heap buffer overflow, which can be exploited to escalate privileges locally.
Vulnerability Detail
In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. This vulnerability can lead to local escalation of privilege via USB fastboot after a bootloader unlock, requiring no additional execution privileges. User interaction is necessary for exploitation, making it a significant security concern for affected devices.
How To Fix
Minimum fixed version
Pixel-family specific:2025-09-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid using USB fastboot until the patch is applied to mitigate potential exploitation.
Conclusion
The CVE-2025-36907 vulnerability presents a significant risk for Android devices, allowing local privilege escalation through a heap buffer overflow. Users are encouraged to update their devices to the latest version to mitigate this risk and should remain vigilant about potential exploitation methods.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36907 is a vulnerability in the Android operating system that allows for local privilege escalation due to a heap buffer overflow.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without needing to sign up.
If your device is vulnerable, you should update to the patched version of Android as soon as it becomes available.
Yes, user interaction is required to exploit this vulnerability, as it involves using USB fastboot after a bootloader unlock.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software, using just the gradle.lockfile.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
