CVE-2025-36937: AudioDecoder Out of Bounds Write Vulnerability in Android
Summary
CVE-2025-36937: In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2025-12-05. Fixed in Pixel-family specific:2025-12-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AudioDecoder component in Android is responsible for decoding audio streams for playback. It is a critical part of the multimedia framework that allows applications to handle audio data efficiently. This component is widely used across various Android devices, particularly in Pixel family devices, to ensure high-quality audio playback. However, a recent vulnerability has been identified that could potentially compromise the security of these devices.
Vulnerability Detail
In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. This vulnerability could allow an attacker to execute arbitrary code remotely without requiring any additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous as it can be triggered automatically through malicious audio streams.
How To Fix
Minimum fixed version
Pixel-family specific:2025-12-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid playing audio files from untrusted sources until the device is updated to the patched version.
Conclusion
The CVE-2025-36937 vulnerability poses a significant risk to Android devices, particularly in the Pixel family. Users are strongly encouraged to update their devices to the latest version to mitigate this risk. Awareness and prompt action are crucial to maintaining device security.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2025-36937 is a vulnerability in the AudioDecoder component of Android that allows for out of bounds writes, potentially leading to remote code execution.
This vulnerability primarily affects users of Pixel family devices running specific versions of Android prior to the patch release on December 5, 2025.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update your device, it is recommended to avoid playing audio files from untrusted sources until a fix is available.
Vulert is a service that monitors and alerts users in real-time for open-source vulnerabilities in software, using just the gradle.lockfile for analysis.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
