CVE-2025-36930: Android Pixel-family Specific Package Out of Bounds Write Vulnerability
Summary
CVE-2025-36930: In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-12-05. Fixed in Pixel-family specific:2025-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The affected package is part of the Android ecosystem, specifically targeting Pixel-family devices. This package is responsible for network address resolution and management. It plays a critical role in ensuring that devices can communicate effectively over networks. However, due to a missing bounds check in the GetHostAddress function within gxp_buffer.h, the package is vulnerable to an out of bounds write, which can lead to serious security implications.
Vulnerability Detail
The vulnerability arises from a lack of proper bounds checking in the GetHostAddress function of gxp_buffer.h. This oversight allows for a potential out of bounds write, which could be exploited to escalate privileges locally. The implications of this vulnerability are significant, as it could allow an attacker to gain unauthorized access to system resources without needing additional execution privileges. Importantly, user interaction is not required for exploitation, making this vulnerability particularly concerning.
How To Fix
Minimum fixed version
Pixel-family specific:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the available patch as soon as it is released.
Conclusion
In summary, CVE-2025-36930 represents a significant security risk for Android Pixel-family devices due to an out of bounds write vulnerability. Users are strongly advised to update their devices to the patched version released on December 5, 2025, to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36930 is a vulnerability in the Android Pixel-family specific package that allows for an out of bounds write due to a missing bounds check.
This vulnerability specifically affects Pixel-family devices running the vulnerable version of the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
No, user interaction is not needed for exploitation, which increases the risk associated with this vulnerability.
While there are no specific workarounds, it is crucial to apply the patch as soon as possible to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
