CVE-2025-32312

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-323138.4In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalCVE-2025-323165.5In gralloc4, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no CVE-2025-323175.5In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no CVE-2025-323188.8In Skia, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no adCVE-2025-323196.7In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions CVE-2025-32327.5A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.CVE-2025-323207.8In System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilegeCVE-2025-323217.8In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This cCVE-2025-323227.8In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabling unauthorized screeCVE-2025-323237.8In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popCVE-2025-323247.8In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead toCVE-2025-323257.8In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of p
CVE-2025-32312: High severity, CVSS 7.8 | Vulnix