CVEvulnerability

CVE-2025-26448

5.5 MEDIUM Published 2025-09-04 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-09-04
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-457

Description

In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected configurations

• google android 13.0 • google android 14.0 • google android 15.0

Weakness · CWE (1)

CWE-457 Use of Uninitialized Variable weakness

References

https://android.googlesource.com/platform/frameworks/base/+/3c1515f4d1942f2453554315a576ed874703f78b Patch, Product
https://source.android.com/security/bulletin/2025-06-01 Vendor Advisory

CVE-2025-26448

Description

Affected configurations

Related

Weakness · CWE (1)

References