CVE-2025-32312 — Deserialization of Untrusted Data in Frameworks Base

CWE-502 — Deserialization of Untrusted Data5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 77.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Platform Frameworks BaseGoogle Android
Timeline
PublishedSep 4
Latest updateSep 5

Description

In createIntentsList of PackageParser.java , there is a possible way to bypass lazy bundle hardening, allowing modified data to be passed to the next process due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶Androidplatform/frameworks_base16-next:0 — 16-next:2025-06-01+3
▶CVEListV5google/android13, 14, 15+2
▶NVDgoogle/android13.0, 14.0, 15.0+2

Patches

Patch: android.googlesource.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-2cvj-3458-7wc9: In createIntentsList of PackageParser↗2025-09-05
▶
CVEList
CVE-2025-32312: In createIntentsList of PackageParser↗2025-09-04
▶
OSV
CVE-2025-32312: In createIntentsList of PackageParser↗2025-06-01
▶

📋Vendor Advisories

1
Android
CVE-2025-32312: Android Security Bulletin 2025-06-01 CVE: CVE-2025-32312 Severity: HIGH Type: EoP Affected AOSP versions: 13, 14, 15 References: A-373467684↗2025-06-01
▶
CVE-2025-32312 — Deserialization of Untrusted Data | cvebase