CVE-2025-32323

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In getCallingAppName of Shared.java, there is a possible way to trick users into granting file access via deceptive text in a permission popup due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-323247.8In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead toCVE-2025-323257.8In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of pCVE-2025-323267.8In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. ThCVE-2025-323277.8In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This could lead to local esCVE-2025-323287.8In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic errCVE-2025-323297.8In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic errCVE-2025-323305.7In generateRandomPassword of LocalBluetoothLeBroadcast.java, there is a possible way to intercept the Auracast audio stream due to an insecuCVE-2025-323317.8In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This couCVE-2025-323327.8In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with CVE-2025-323337.8In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. This could lCVE-2025-32347.2The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versCVE-2025-323457.8In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user