CVE-2025-32325 Overview
CVE-2025-32325 is a heap-based buffer overflow in the appendFrom function of Parcel.cpp within the Android platform framework. The flaw enables an out-of-bounds write in native code that handles inter-process communication (IPC) parcels. A local attacker with low privileges can trigger the overflow to escalate privileges on the device. Exploitation requires no user interaction. The vulnerability affects Android versions 13, 14, 15, and 16, and is addressed in the Android Security Bulletin for September 2025.
Critical Impact
A local, low-privileged app can corrupt heap memory in a privileged Android process, leading to local privilege escalation without user interaction.
Affected Products
- Google Android 13
- Google Android 14
- Google Android 15
- Google Android 16
Discovery Timeline
- 2025-09-04 - CVE-2025-32325 published to the National Vulnerability Database (NVD)
- 2025-09-01 - Google publishes fix in the Android Security Bulletin (September 2025)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-32325
Vulnerability Analysis
The vulnerability resides in Parcel::appendFrom inside frameworks/native/libs/binder/Parcel.cpp. Parcels are the serialization primitive used by Binder IPC across Android system services and applications. The appendFrom method copies a range of bytes and object metadata from a source Parcel into a destination Parcel. Insufficient validation of length or offset arithmetic during this copy allows the destination heap buffer to be written past its allocated size, producing an out-of-bounds write classified as [CWE-122] heap-based buffer overflow.
Because Binder is the primary IPC channel on Android, a malicious client can craft a Parcel and invoke a system service that internally calls appendFrom. The resulting heap corruption occurs inside the privileged service, giving an attacker a path to code execution or data tampering in a context more privileged than the calling app.
Root Cause
The root cause is unchecked or improperly bounded arithmetic on parcel sizes and object counts during the append operation. When attacker-controlled lengths bypass the sanity checks, the subsequent memcpy writes beyond the destination allocation on the heap. The upstream fix in the Android platform commit 96f0dd71bc07051e4faae44abf7121a3f7b5b2aa tightens these bounds checks in Parcel.cpp.
Attack Vector
An attacker installs or already runs a local, unprivileged application on the target device. The app sends a crafted parcel over Binder to a system service that invokes appendFrom. Heap corruption in the receiving service enables privilege escalation. No user interaction and no additional execution privileges are required. Because the flaw is reachable only locally, remote network exploitation is not applicable.
No public proof-of-concept or in-the-wild exploitation has been reported. Consult the Android Framework Commit and the Android Security Bulletin September 2025 for authoritative technical details.
Detection Methods for CVE-2025-32325
Indicators of Compromise
- Unexpected crashes or tombstone_* files in /data/tombstones/ referencing libbinder.so or Parcel::appendFrom with SIGSEGV/SIGABRT.
- System services such as system_server, mediaserver, or surfaceflinger restarting repeatedly on a device running Android 13, 14, 15, or 16 without the September 2025 patch.
- Installation of untrusted third-party APKs shortly before the appearance of Binder-related native crashes.
Detection Strategies
- Ingest Android logcat, dropbox, and tombstone artifacts into a centralized logging pipeline and alert on native crashes involving libbinder or Parcel.
- Track the device build fingerprint and security patch level; flag any device where ro.build.version.security_patch is earlier than 2025-09-01.
- Monitor mobile threat defense telemetry for apps that issue high volumes of Binder transactions or attempt to load native libraries interacting with system services.
Monitoring Recommendations
- Enforce enterprise mobile device management (MDM) compliance rules that report Android security patch level and quarantine non-compliant devices.
- Correlate app install events with subsequent native crashes in privileged services to identify potentially malicious apps.
- Review Google Play Protect status and sideloading policies across the managed fleet.
How to Mitigate CVE-2025-32325
Immediate Actions Required
- Apply the Android security patch level 2025-09-01 or later on all Android 13, 14, 15, and 16 devices.
- Prioritize patching for privileged users, developer devices with USB debugging enabled, and devices that permit sideloaded applications.
- Remove untrusted or unnecessary third-party applications, especially those requesting broad IPC-related permissions.
Patch Information
Google addressed the flaw in the September 2025 Android Security Bulletin. The upstream fix is captured in the platform framework commit 96f0dd71bc07051e4faae44abf7121a3f7b5b2aa. Original equipment manufacturers (OEMs) ship the fix as part of their monthly security patch level of 2025-09-01 or newer. See the Android Security Bulletin September 2025 and the Android Framework Commit for authoritative details.
Workarounds
- No vendor-supplied workaround exists; the fix requires installing the September 2025 or later Android security patch.
- Restrict application installation to Google Play and disable sideloading via MDM policy to reduce the local attack surface until patches are deployed.
- Enable Google Play Protect and require devices to be enrolled in enterprise mobility management before granting access to corporate resources.
# Verify the Android security patch level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for a patched device: 2025-09-01 (or later)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
