CVE-2025-36918CWE-125

CVE-2025-36918

High · published December 12, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.9
In the wild
Unconfirmed
What it is

⚡ A sneaky out of bounds read could let the bad guys waltz right into your system! No user interaction is needed to exploit this vulnerability! Think of it like a restaurant that doesn't check IDs at the door. Without proper verification, anyone could walk in, and once they're in the kitchen, they could cook up whatever they want! If exploited, this vulnerability could allow an attacker to escalate their privileges locally, gaining access to sensitive system functions. It’s like handing over the chef's hat to an unauthorized diner, giving them the power to alter the entire menu — absolutely devastating!

Put simply

Think of it like a restaurant that doesn't check IDs at the door. Without proper verification, anyone could walk in, and once they're in the kitchen, they could cook up whatever they want! This vulnerability arises from improper input validation in the 'aoc_service_read_message' function, which may cause out of bounds reads, leading to elevated privileges if an attacker can access the system.

What to do

If exploited, this vulnerability could allow an attacker to escalate their privileges locally, gaining access to sensitive system functions. It’s like handing over the chef's hat to an unauthorized diner, giving them the power to alter the entire menu — absolutely devastating! To protect yourself, ensure you update your software to the latest version where this issue is patched. Review your input validation processes to prevent similar issues in the future. Don't wait—act now to keep your environment safe! You've got this! With these steps, you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00103 · 0.9th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-12-12T01:15Z
Affected products (1)
ProductVersionsFixed in
google/androidall versions—
References (1)
EPSS history
Timeline
  • 11 DEC 19:35Z
    In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation
    cvelistv5