CVE-2025-36907: Google Android Privilege Escalation Flaw

CVE-2025-36907 Overview

CVE-2025-36907 is a heap buffer overflow in the Android bootloader function draw_surface_image() located in abl/android/lib/draw/draw.c. The flaw allows an out-of-bounds write on the heap, which can lead to local privilege escalation. Exploitation requires an unlocked bootloader, physical USB fastboot access, and user interaction. No additional execution privileges are needed once these preconditions are met. Google addressed the issue in the Android Security Bulletin for September 2025. The vulnerability is tracked under CWE-122: Heap-based Buffer Overflow.

Critical Impact
An attacker with physical device access and an unlocked bootloader can escalate privileges through crafted USB fastboot input processed by the Android Bootloader (ABL).

Affected Products

Google Android (Pixel devices using the ABL bootloader)
Devices addressed by the Pixel Security Bulletin dated 2025-09-01
Android builds containing the vulnerable draw_surface_image() implementation

Discovery Timeline

2025-09-04 - CVE-2025-36907 published to the National Vulnerability Database
2025-09-01 - Google publishes the Android Pixel Security Bulletin addressing the flaw
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-36907

Vulnerability Analysis

The vulnerability resides in the draw_surface_image() routine in abl/android/lib/draw/draw.c, part of the Android Bootloader (ABL) drawing library. The function performs an out-of-bounds write on a heap allocation while rendering a surface image. Because the code runs before the Android kernel and userspace boot, corruption inside the bootloader heap can influence subsequent boot state and executed code. A successful write beyond the intended buffer boundary lets an attacker corrupt adjacent heap metadata or function pointers used later during the boot sequence.

Root Cause

The defect is a classic heap-based buffer overflow [CWE-122]. The image-drawing logic writes past the end of a heap-allocated buffer, likely because size or bounds checks on attacker-controlled image dimensions or pixel data are missing or incorrect. Input reaches this code path via USB fastboot commands that supply surface image data to the bootloader.

Attack Vector

Exploitation is local and requires physical access to the target device. The attacker must first unlock the bootloader, which itself triggers factory data reset and user consent on Pixel hardware. With the bootloader unlocked, the attacker connects the device over USB in fastboot mode and issues commands that cause the vulnerable draw_surface_image() path to process malicious data. User interaction on the device is also required to complete the exploitation flow. Successful exploitation yields code execution at bootloader privilege, effectively bypassing Android's verified boot and application sandbox model.

No public proof-of-concept code is available for this issue. Consult the Android Security Bulletin September 2025 for vendor technical details.

Detection Methods for CVE-2025-36907

Indicators of Compromise

Devices reporting an unlocked bootloader state (ro.boot.flash.locked=0) in fleet inventory when policy requires locked bootloaders.
Fastboot session artifacts on management hosts showing repeated fastboot boot or image-flash commands against production devices.
Verified Boot state reported as orange or red in Android attestation payloads.

Detection Strategies

Use Android Key Attestation and Play Integrity API responses to identify devices with tampered or unlocked bootloaders in enterprise fleets.
Monitor Mobile Device Management (MDM) telemetry for security patch level below the 2025-09-01 SPL on Pixel devices.
Alert on USB device enumeration events on managed workstations showing Android fastboot vendor and product identifiers outside of approved engineering hosts.

Monitoring Recommendations

Track Android security patch level compliance across all managed devices and enforce updates to the September 2025 bulletin or later.
Review physical access controls and chain-of-custody procedures for corporate mobile devices, since exploitation requires hands-on USB access.
Correlate attestation failures with user account activity to identify devices that may have been tampered with offline.

How to Mitigate CVE-2025-36907

Immediate Actions Required

Apply the Android security patch level 2025-09-01 or later on all affected Pixel devices as published by Google.
Enforce a policy that all corporate Android devices maintain a locked bootloader and pass Verified Boot attestation.
Restrict physical access to unattended devices and require full-disk encryption with a strong screen lock credential.

Patch Information

Google released fixes as part of the Android Security Bulletin September 2025. Devices running the 2025-09-01 patch level or later contain the corrected draw_surface_image() implementation. Enterprises using MDM should push the update and verify installation by checking ro.build.version.security_patch on managed endpoints.

Workarounds

Keep the bootloader locked; the vulnerability requires an unlocked bootloader before exploitation is possible.
Disable or physically block USB data connectivity on high-risk devices using MDM USB restriction policies.
Require attestation checks in enterprise applications and deny access to services from devices reporting an unlocked bootloader.

bash

# Verify current security patch level and bootloader state on a connected device
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.boot.verifiedbootstate
adb shell getprop ro.boot.flash.locked