CVE-2025-36919CWE-415

CVE-2025-36919

High · published December 12, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

⚡ A double free in aoc_channel_dev.c could be your ticket to trouble! An attacker can exploit this without needing to be a superuser or even interact with the system. 🔥 Think of it like a restaurant receiving twice the payment for the same meal—no one’s checking the order, and suddenly they’ve got more cash than they should. Here, the improper locking is like loose accounting, allowing an attacker to cash in unexpectedly! An attacker could escalate their privileges locally, gaining unauthorized access to sensitive data or administrative functions—basically walking into the back office and taking control! This could lead to devastating consequences if you're not prepared. Imagine the chaos in your restaurant when an intruder takes over the kitchen!

Put simply

Think of it like a restaurant receiving twice the payment for the same meal—no one’s checking the order, and suddenly they’ve got more cash than they should. Here, the improper locking is like loose accounting, allowing an attacker to cash in unexpectedly! The vulnerability arises from a double free caused by improper locking in the `aocc_read` function. This allows a local user to exploit the flaw without additional execution privileges, making it particularly sneaky.

What to do

An attacker could escalate their privileges locally, gaining unauthorized access to sensitive data or administrative functions—basically walking into the back office and taking control! This could lead to devastating consequences if you're not prepared. Imagine the chaos in your restaurant when an intruder takes over the kitchen! To protect yourself, ensure that your system is patched to the latest version where this issue is resolved. Review your security policies and implement stricter memory management practices to prevent similar issues in the future. It's crucial to stay vigilant! You've got this! By taking the necessary steps, you can secure your system and keep those pesky intruders at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00078 · 0.1th percentile
Weakness
CWE-415 · Double Free
Published
2025-12-12T01:15Z
Affected products (1)
ProductVersionsFixed in
google/androidall versions—
References (1)
EPSS history
Timeline
  • 11 DEC 19:35Z
    In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking
    cvelistv5