CVE-2025-36897
Published: 04 September 2025
Summary
CVE-2025-36897 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 44.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-36897 is a critical vulnerability (CVSS 9.8) involving a possible out-of-bounds write due to a missing bounds check in cd_CnMsgCodecUserApi.cpp (CWE-787). It affects Google Pixel devices, as documented in the Android security bulletin for September 2025.
A remote attacker can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N) required. Successful exploitation could lead to remote code execution in the context of the affected component (C:H/I:H/A:H), without additional execution privileges needed.
The Android Pixel security bulletin dated 2025-09-01 addresses this issue with patches for affected devices. For mitigation details, refer to https://source.android.com/security/bulletin/pixel/2025-09-01.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-26687
Vulnerability details
In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write with AV:N/UI:N/PR:N directly enables unauthenticated remote code execution on the client device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces bounds checking on untrusted network inputs to the message codec API, preventing the out-of-bounds write vulnerability.
Implements memory protections such as ASLR, DEP, and stack canaries to block remote code execution from buffer overflow exploits.
Mandates identification, reporting, and patching of the specific out-of-bounds write flaw in cd_CnMsgCodecUserApi.cpp to eliminate the vulnerability.