CVE-2025-36931: Android Pixel-family Specific Out of Bounds Write Vulnerability
Summary
CVE-2025-36931: In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-12-05. Fixed in Pixel-family specific:2025-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vulnerability affects the Android ecosystem, specifically within the Pixel-family devices. The impacted package is related to the handling of host addresses in the gxp_buffer.h file. This package is integral for network communication, managing how devices resolve and interact with host addresses. The vulnerability arises from a missing bounds check, making it susceptible to exploitation.
Vulnerability Detail
In the GetHostAddress function of gxp_buffer.h, there is a potential out of bounds write due to a missing bounds check. This flaw can lead to local escalation of privilege, allowing an attacker to gain unauthorized access to system resources without needing additional execution privileges. User interaction is not required for exploitation, making it a significant security concern.
How To Fix
Minimum fixed version
Pixel-family specific:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-36931 represents a serious vulnerability within the Android ecosystem, specifically affecting Pixel-family devices. Users are strongly encouraged to update their devices to the latest patched version to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36931 is a vulnerability in the Android ecosystem that allows for an out of bounds write due to a missing bounds check in the gxp_buffer.h file.
This vulnerability can lead to local escalation of privilege, potentially allowing unauthorized access to system resources on affected Pixel-family devices.
No, user interaction is not needed for exploitation, making it particularly concerning.
The best way to protect your device is to update to the patched version (2025-12-05) as soon as it is available.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
