Out of Bounds Write Vulnerability in Android's LibAOC WAVES Product
CVE-2025-36925

7.8HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
11 December 2025

What is CVE-2025-36925?

A vulnerability exists in the WAVES_send_data_to_dsp function of libaoc_waves.c, leading to a potential out of bounds write. This flaw arises due to an absence of adequate bounds checks, allowing an attacker to escalate privileges locally without needing any additional execution privileges. Notably, this exploitation does not require any user interaction, highlighting a significant security risk that could affect the integrity of devices utilizing this component.

Affected Version(s)

Android Android kernel

References

https://source.android.com/security/bulletin/pixel/2025-1...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-36925 : Out of Bounds Write Vulnerability in Android's LibAOC WAVES Product