CVE-2025-36917: Android Pixel-family Specific DoS Vulnerability in up_L2commonPdcpSecurity.cpp
Summary
CVE-2025-36917: In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-12-05. Fixed in Pixel-family specific:2025-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically targeting Pixel-family devices. This package is responsible for handling various security protocols within the device's communication layers. Its functionality is crucial for maintaining secure data transmission and ensuring the integrity of user communications. However, due to a flaw in its bounds checking mechanism, it is susceptible to denial of service attacks, which can disrupt normal operations.
Vulnerability Detail
In the function SwDcpItg of up_L2commonPdcpSecurity.cpp, there exists a vulnerability stemming from an incorrect bounds check. This flaw allows an attacker to exploit the system remotely, leading to a denial of service without requiring any additional execution privileges. The vulnerability does not necessitate user interaction for exploitation, making it particularly dangerous as it can be triggered silently, potentially affecting a wide range of users.
How To Fix
Minimum fixed version
Pixel-family specific:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability aside from applying the patch. Users are advised to monitor their devices for updates and apply them as soon as they become available.
Conclusion
In summary, CVE-2025-36917 represents a serious denial of service vulnerability affecting Android Pixel-family devices due to a flaw in bounds checking. Users are strongly encouraged to update their devices to the latest patched version to protect against potential exploitation. Regular monitoring for updates and using tools like Vulert can help maintain software security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36917 is a vulnerability in the Android Pixel-family devices that allows for remote denial of service due to an incorrect bounds check in the up_L2commonPdcpSecurity.cpp file.
If you own a Pixel-family device running the affected version of Android, you may be at risk. You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If your device is affected, you should update to the patched version released on December 5, 2025, to mitigate the risk of exploitation.
No, user interaction is not needed for the exploitation of this vulnerability, making it a significant risk.
Vulert is a monitoring tool that uses the gradle.lockfile to track open-source vulnerabilities in your software in real-time. It can alert you to potential issues without requiring access to your code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
