CVE-2025-36935 Overview
CVE-2025-36935 is a local privilege escalation vulnerability in Google Android. The flaw resides in the trusty_ffa_mem_reclaim function of shared-mem-smcall.c, part of the Trusty Trusted Execution Environment (TEE) shared memory handling. Uninitialized data in this path can cause memory corruption, allowing a local attacker to escalate privileges without additional execution privileges or user interaction. The issue is tracked under CWE-787 (Out-of-bounds Write) and CWE-457 (Use of Uninitialized Variable). Google disclosed the flaw in the Android Security Bulletin December 2025.
Critical Impact
Local attackers can corrupt memory in the Trusty shared-memory reclaim path to escalate privileges on affected Android devices.
Affected Products
- Google Android (Pixel devices covered by the December 2025 Pixel bulletin)
- Devices using the Trusty TEE shared-mem-smcall component
- Android builds prior to the December 2025 security patch level
Discovery Timeline
- 2025-12-11 - CVE-2025-36935 published to NVD
- 2025-12-01 - Fix included in the Android Security Bulletin December 2025
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-36935
Vulnerability Analysis
The vulnerability exists inside trusty_ffa_mem_reclaim, a function that processes Firmware Framework for Arm (FF-A) memory reclaim requests within Android's Trusty TEE. The reclaim path handles shared memory buffers previously loaned between the Normal World and Secure World. When the function operates on uninitialized data, downstream logic acts on stale or attacker-influenceable stack or structure contents, resulting in memory corruption inside a privileged context.
Because Trusty runs with high trust on the device, corruption in this path allows privilege escalation from a local unprivileged process into higher-privileged components. Exploitation requires only local access and low privileges, and does not require user interaction.
Root Cause
The root cause combines CWE-457 and CWE-787. A variable or structure field in shared-mem-smcall.c is used before initialization during the FF-A memory reclaim flow. That uninitialized value influences a subsequent write operation, producing an out-of-bounds write that corrupts adjacent memory.
Attack Vector
An attacker with local code execution on the device issues crafted FF-A shared memory reclaim calls into Trusty. The malicious input steers the uninitialized-value code path so that memory corruption occurs in the secure-side handler. Successful exploitation yields elevated privileges within the Android trust boundary. Public proof-of-concept code is not available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Google has not published exploitation code. Refer to the Android Security Bulletin December 2025 for vendor technical details.
Detection Methods for CVE-2025-36935
Indicators of Compromise
- Unexpected crashes or panics in the Trusty TEE or trusted_uio kernel driver logs
- Anomalous FF-A SMC calls originating from non-system user IDs
- Local processes attempting to load or interact with Trusty IPC endpoints outside their normal profile
Detection Strategies
- Audit Android build fingerprints and security patch levels against the December 2025 Pixel bulletin
- Monitor logcat and kernel ring buffer output for Trusty driver faults referencing shared-memory reclaim
- Track unauthorized native binaries invoking Trusty ioctls on managed devices via mobile threat defense telemetry
Monitoring Recommendations
- Enforce security patch level compliance checks in mobile device management (MDM) policies
- Collect device attestation and boot integrity signals to detect post-exploitation tampering
- Alert on repeated Trusty crashes or reboots on individual devices, which may indicate exploitation attempts
How to Mitigate CVE-2025-36935
Immediate Actions Required
- Apply the December 2025 Android security patch level or later on all affected devices
- Restrict installation of untrusted third-party applications, which are the primary local attack surface
- Enforce MDM policies that block devices below the required patch level from accessing corporate resources
Patch Information
Google addressed CVE-2025-36935 in the December 2025 Android Security Bulletin. Device users and administrators should update to a build with security patch level 2025-12-01 or later. See the Android Security Bulletin December 2025 for source-code fix references and device-specific rollout guidance.
Workarounds
- No vendor-supplied workaround exists; patching is the only supported remediation
- Reduce local attack surface by disabling developer options and USB debugging on production devices
- Limit sideloading and require applications from vetted enterprise or official app stores
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
