Skip to content
OpenAdvisories
High WID-SEC-2025-2726 25 CVEs

Google Android Pixel: Mehrere Schwachstellen

Published Dec 2, 2025 · Updated Jan 18, 2026 · Revision 3 · de-DE

Vendor: Google Product: Android Platform: Android

Summary

Ein Angreifer kann mehrere Schwachstellen in Google Android Pixel ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.

Product

Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.

Vulnerabilities 25

  • Critical 9.8
    CVE-2025-36937

    In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect …

    Google Android Android
  • Critical 9.8
    CVE-2025-54957 Public exploit

    An issue was discovered in Dolby UDC 4.5 through 4.13. A crash of the DD+ decoder process can occur when a malformed DD…

  • High 8.0
    CVE-2025-36923

    In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a hea…

    Google Android Android
  • High 8.0
    CVE-2025-36924

    In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to an incorrec…

    Google Android Android
  • High 7.8
    CVE-2025-36918

    In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation.…

    Google Android Android
  • High 7.8
    CVE-2025-36919

    In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking. This could lead to local es…

    Google Android Android
  • High 7.8
    CVE-2025-36925

    In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check. Thi…

    Google Android Android
  • High 7.8
    CVE-2025-36927

    In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check.…

    Google Android Android
  • High 7.8
    CVE-2025-36928

    In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check. This could…

    Google Android Android
  • High 7.8
    CVE-2025-36930

    In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could le…

    Google Android Android
  • High 7.8
    CVE-2025-36931

    In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could le…

    Google Android Android
  • High 7.8
    CVE-2025-36932

    In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to im…

    Google Android Android
  • High 7.8
    CVE-2025-36935

    In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data. This…

    Google Android Android
  • High 7.8
    CVE-2025-36936

    In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow. Th…

    Google Android Android
  • High 7.5
    CVE-2025-26781

    An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 21…

  • High 7.5
    CVE-2025-26782

    An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 21…

  • High 7.4
    CVE-2025-36934

    In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race c…

    Google Android Android
  • High 7.0
    CVE-2025-36916

    In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition. This could le…

    Google Android Android
  • Medium 6.8
    CVE-2025-36938

    In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead …

    Google Android Android
  • Medium 6.7
    CVE-2025-36922

    In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free. This could lead to loc…

    Google Android Android
  • Medium 6.5
    CVE-2025-36912

    In cellular modem, there is a possible denial of service due to a logic error in the code. This could lead to remote de…

    Google Android Android
  • Medium 6.5
    CVE-2025-36917

    In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check. Thi…

    Google Android Android
  • Medium 5.5
    CVE-2025-36889

    In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lea…

    Google Android Android
  • Medium 5.5
    CVE-2025-36921

    In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds c…

    Google Android Android
  • Medium 5.5
    CVE-2025-36929

    In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation. …

    Google Android Android

Revision history

  1. #3

    PoC aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2025-202869, EUVD-2025-202868, EUVD-2025-202867, EUVD-2025-202866, EUVD-2025-202865, EUVD-2025-202863, EUVD-2025-202856, EUVD-2025-202855, EUVD-2025-202851, EUVD-2025-202849, EUVD-2025-202848, EUVD-2025-202847, EUVD-2025-202845, EUVD-2025-202844, EUVD-2025-202842, EUVD-2025-202841, EUVD-2025-202882, EUVD-2025-202884, EUVD-2025-202883, EUVD-2025-202885, EUVD-2025-202850, EUVD-2025-202886

  3. #1

    Initiale Fassung

References