CVE-2025-0081: Google Android DoS Vulnerability

CVE-2025-0081 Overview

CVE-2025-0081 is a denial-of-service vulnerability in the Android DNG (Digital Negative) SDK. The flaw resides in the dng_lossless_decoder::HuffDecode function within dng_lossless_jpeg.cpp. The component processes lossless JPEG data embedded in DNG raw image files. The function uses uninitialized data during Huffman decoding, which can trigger a crash when a malformed image is parsed. Remote attackers can exploit the issue without user interaction and without elevated privileges. Google addressed the issue in the Android Security Bulletin March 2025. The vulnerability is classified under [CWE-457] Use of Uninitialized Variable.

Critical Impact

Remote attackers can crash Android image processing components by delivering crafted DNG files, with no user interaction required.

Affected Products

• Google Android 12.0 and 12.1
• Google Android 13.0 and 14.0
• Google Android 15.0

Discovery Timeline

• 2025-08-26 - CVE-2025-0081 published to NVD
• 2025-09-02 - Last updated in NVD database

Technical Details for CVE-2025-0081

Vulnerability Analysis

The vulnerability sits in the Huffman decoder used by Android's lossless JPEG path inside the DNG SDK. When HuffDecode runs against a malformed bitstream, it consumes a value from a buffer or local variable that was never initialized. The decoder then uses that data as control flow input, table index, or bit count. This produces unpredictable behavior, including out-of-range accesses that abort the process. Because DNG parsing runs whenever a raw image is decoded, the trigger surface includes media scanning, gallery thumbnailing, and any application that opens attacker-supplied raw images.

Root Cause

The root cause is improper initialization of decoder state before entry into the Huffman lookup path. The original code did not set deterministic defaults for fields consumed when input symbols fell outside the expected Huffman table entries. The upstream fix is published in the Android DNG SDK update, which corrects the initialization path so that malformed inputs no longer reach unset memory.

Attack Vector

An attacker delivers a crafted DNG or embedded lossless JPEG image to a target Android device. Delivery channels include messaging applications, email attachments, web downloads, and content shared through file managers. When an application or system component decodes the file, HuffDecode reads uninitialized state and the process crashes. Repeated delivery can produce sustained denial of service against media-handling services. The flaw does not grant code execution or data disclosure on its own, but it can be chained with other primitives in research scenarios.

Detection Methods for CVE-2025-0081

Indicators of Compromise

• Repeated crashes in mediaserver, media.codec, gallery, or camera processes referencing dng_lossless_jpeg or HuffDecode in tombstone logs.
• Inbound DNG or TIFF-based raw image files received from untrusted sources, especially over messaging or email.
• ANR (Application Not Responding) events tied to image preview generation on Android 12 through 15.

Detection Strategies

• Inspect Android tombstone and logcat output for SIGSEGV or SIGABRT events tied to the DNG decoder symbol set.
• Use mobile threat defense telemetry to flag files with DNG headers that fail structural validation before being opened by user applications.
• Correlate device crash spikes with recent file deliveries to identify potential exploitation attempts.

Monitoring Recommendations

• Forward Android crash reports and EDR mobile telemetry into a central data lake for pattern analysis across the fleet.
• Track Android patch level (ro.build.version.security_patch) to identify devices missing the March 2025 update.
• Alert on processes that decode raw images and terminate abnormally within short time windows on the same device.

How to Mitigate CVE-2025-0081

Immediate Actions Required

• Apply the Android security patch level 2025-03-01 or later to all affected devices.
• Restrict installation and usage of applications that automatically decode raw image attachments from untrusted sources.
• Validate that managed devices report the updated patch level through MDM compliance policies.

Patch Information

Google released the fix in the Android Security Bulletin March 2025. The corresponding source change is available in the Android DNG SDK commit 7fc02c8d. Device vendors must integrate the AOSP patch and ship it through their over-the-air channels for downstream protection.

Workarounds

• Disable automatic preview and thumbnail generation for raw image formats in messaging and email clients where configurable.
• Block DNG and raw image attachments at email and web gateways for environments that do not require them.
• Limit exposure of mobile devices to untrusted file shares until the March 2025 patch is applied.