Google Pixel
CVE-2025-36925
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun low-privileged app on Pixel device
-
DeliveryCraft oversized WAVES DSP payload
-
ExploitTrigger OOB write in WAVES_send_data_to_dsp
-
ExecutionCorrupt adjacent memory
-
ImpactEscalate to higher privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local code execution on the affected device: the attacker must already run code at low privilege (PR:L) on a Pixel/Tensor device whose firmware includes the AoC WAVES audio path (libaoc_waves.c), then reach the WAVES_send_data_to_dsp routine to deliver an out-of-bounds write. No user interaction is required (UI:N). Limiting factors: no remote vector (AV:L, must already be on-device), the vulnerable code appears specific to Pixel/Tensor AoC rather than generic Android, and unpatched firmware predating the 2025-12-01 Pixel bulletin is required. |
| Impact | Real-world risk is moderate and characteristic of a local kernel/firmware-path privilege-escalation bug. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: exploitation is local (AV:L), needs low but non-zero privileges (PR:L, i.e. a running app/process on the device), requires no user interaction (UI:N), and yields full CIA impact within the same security scope. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data - so this is 'no public exploit identified at time of analysis' rather than actively exploited. No SSVC decision data was supplied. There is no conflict between the CVSS vector and the description; both point to local escalation of privilege. The main caveat is scope: the CPE is the generic cpe:2.3:o:google:android but the affected code (libaoc_waves.c, an AoC/Always-on-Compute audio-DSP path) and the Pixel security bulletin reference indicate this is a Pixel/Tensor component rather than all Android devices - narrowing real-world exposure. Net: a legitimate patch-priority item for Pixel/Tensor fleets, not an internet-facing emergency. |
| Exploit ScenarioDerived | A malicious or compromised app already running on a Pixel device with low privileges sends crafted data through the WAVES audio path to the AoC DSP. Because WAVES_send_data_to_dsp lacks a bounds check, the oversized/crafted payload triggers an out-of-bounds write, corrupting adjacent memory to gain higher privileges with no user interaction. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
An out-of-bounds write in the WAVES_send_data_to_dsp routine of libaoc_waves.c can allow a local attacker to escalate privileges on affected Google Pixel/Tensor devices. Per the CVSS vector (AV:L/AC:L/PR:L/UI:N), an attacker must already have the ability to run code at low privilege on the device and reach the Always-On Compute (AoC) WAVES audio/DSP path; no further privileges and no user interaction are needed to trigger the memory corruption. The issue is host-specific to Pixel/Tensor firmware rather than generic Android, carries no confirmed active exploitation or known public exploit at time of analysis, and is addressed through the Android Pixel security bulletin dated 2025-12-01.
RemediationAI
Vendor-released patch: apply the Google Pixel security bulletin dated 2025-12-01 (https://source.android.com/security/bulletin/pixel/2025-12-01), which contains the firmware fix for the missing bounds check in WAVES_send_data_to_dsp; no standalone patched version number is published in the available data, so remediation is by installing the Pixel system/firmware update for that bulletin, available via over-the-air updates and Google's published factory/OTA images. Where immediate update is not possible, compensating controls should target the prerequisite rather than the flaw itself: restrict the ability to run untrusted or low-privilege native code on the device by enforcing strict app sandboxing and disabling developer/root access and sideloading, since the bug is only reachable after local code execution (AV:L/PR:L/UI:N) and cannot be triggered remotely. Because there is no confirmed in-the-wild exploitation or public exploit code, no emergency mitigations beyond prompt patching are indicated; if an update cannot be applied, treat affected devices as higher-risk for local chain exploitation and avoid running untrusted software on them.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is libaoc_waves.c, part of the AoC (Always-On Compute) firmware/driver stack on Google Tensor SoCs that handles the WAVES audio data path. The root-cause class is CWE-787 (Out-of-bounds Write): the WAVES_send_data_to_dsp function transfers caller-supplied data into a DSP-bound buffer without validating the supplied length or offset against the destination buffer size, so an oversized or malformed request causes a write past the end of the intended buffer. Because this code executes in a privileged firmware/kernel-adjacent context, corrupting adjacent memory can be leveraged to redirect execution or corrupt control data, producing local elevation of privilege with high confidentiality, integrity, and availability impact (C:H/I:H/A:H) under an unchanged scope. The reported CPE (cpe:2.3:o:google:android) reflects the Android platform mapping, but the affected code is specific to the Pixel/Tensor AoC WAVES path rather than the Android platform in general.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local on-device attacker with low privilege and no user interaction triggers an OOB write yielding full same-scope privilege escalation, matching AV:L/PR:L/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (google).
CVSS VectorVendor: google
DescriptionCVE.org
In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
A memory-corruption flaw in the audio digital signal processing path of Google Pixel and Tensor-based devices allows an attacker who already runs code at low privilege on the handset to elevate their access to a more trusted level of the device. Impact is concentrated on organizations that issue or support Pixel hardware, where a compromised app or malicious local actor could turn an ordinary user-level foothold into deeper device control affecting corporate email, MFA tokens, and managed data on that phone. Because the flaw is specific to Pixel/Tensor firmware and no vendor patch has been identified at this time, risk is driven by device inventory and mobile threat exposure rather than by broad Android ecosystem impact.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing restrictions on sideloaded or unknown-source applications to prevent the initial low-privilege foothold, tightening Google Play Protect and microphone/audio permission policies, applying mobile device management work profile separation and conditional access so sensitive corporate data is not reachable from an escalated process, and monitoring Pixel and Tensor devices for anomalous audio or DSP behavior until the fix published through the Android Pixel security bulletin dated 2025-12-01 is deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
GitHub PoC
Exploit-DB