Google Android
CVE-2025-36936
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun code as low-privilege local app
-
DeliveryCall GetTachyonCommand with crafted size
-
ExploitTrigger integer overflow (CWE-190)
-
ExecutionCause out-of-bounds heap write
-
ImpactCorrupt memory to escalate privilege
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already execute code locally on the device as a low-privilege process (PR:L) able to reach the GetTachyonCommand routine in the Tachyon server-common native code; no user interaction and no additional execution privileges are needed. The limiting factors are the local-only attack surface (an app or process must already be present on the device) and dependence on a device running an Android/Pixel build that ships the vulnerable tachyon_server_common.h component and has not applied the 2025-12-01 security patch level. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a locally-exploitable integer-overflow-driven out-of-bounds write in GetTachyonCommand (tachyon_server_common.h), a native Android component tied to Google's Tachyon real-time-communications stack. The attack vector is local (AV:L) and requires low privileges (PR:L) but no user interaction (UI:N) with low complexity (AC:L), consistent with the description's 'local escalation of privilege with no additional execution privileges needed.' No EPSS score, KEV listing, or POC is present in the supplied intelligence, so at present there is no public exploit identified and no evidence of active exploitation. This is a genuine but bounded priority: memory-corruption privilege escalations in Android native code are attractive as links in exploit chains (they let a compromised low-privilege app break out), but the local-only vector means it is not remotely wormable and requires an attacker to already run code on the device. Treat as a routine patch-management item at the December 2025 Android/Pixel security level rather than an emergency; no signals conflict with the CVSS vector. |
| Exploit ScenarioDerived | A malicious or compromised low-privilege Android app already installed on the device invokes the vulnerable GetTachyonCommand path with a crafted length/size value, triggering an integer overflow that yields an undersized allocation and a subsequent out-of-bounds write. By shaping heap contents the attacker corrupts adjacent memory to escalate to a higher-privileged context, all without user interaction. No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Local privilege escalation in Google Android's Tachyon component allows a locally positioned low-privilege attacker to corrupt memory and potentially elevate privileges via an integer overflow in GetTachyonCommand within tachyon_server_common.h. The issue affects Android/Pixel builds that ship the vulnerable Tachyon real-time-communications native code and have not applied the December 2025 security patch; exploitation requires local code execution by a low-privilege process (PR:L) and no user interaction (UI:N). CVSS 3.1 score is 7.8 HIGH, and no public exploit identified at time of analysis.
RemediationAI
Patch available per vendor advisory; apply the Android security update associated with the December 2025 Pixel bulletin (https://source.android.com/security/bulletin/pixel/2025-12-01) to reach security patch level 2025-12-01 or later. No exact build number or commit is provided in the input data, so consult the bulletin for device-specific guidance. Because exploitation requires a local low-privilege process, reduce the local attack surface by enforcing Google Play Protect, restricting sideloading and untrusted app installation through Android Enterprise or device-owner policies, and auditing apps that can run natively on the device; these controls lower risk but do not fully mitigate an already-running malicious local process. If Tachyon/RTC functionality is not required and device management policy supports it, disabling or restricting the relevant Tachyon service/component can remove the attack surface, with the trade-off of breaking real-time communications features that depend on it. No public exploit was identified, so prioritize patching over emergency isolation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2025-36936 is a native memory-safety flaw in Android's Tachyon real-time-communications stack, specifically in GetTachyonCommand in tachyon_server_common.h. The root cause is CWE-190 integer overflow: an arithmetic calculation used for size or index management can wrap, after which the code performs an out-of-bounds write. Because the vulnerable code is native and reachable by a local process, a low-privilege app or process on the device can trigger the corruption and potentially execute code or modify memory at higher privilege. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local access, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact. CPE cpe:2.3:o:google:android:-:*:*:*:*:*:*:* identifies the affected platform as Google Android rather than a specific app.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation reachable by an already-present low-privilege process (AV:L/PR:L), no user interaction, and memory corruption yielding full high C/I/A impact within an unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Google Android's Tachyon component is affected by a high-severity local privilege escalation vulnerability (CVE-2025-36936) that impacts unpatched Android and Pixel devices. A malicious application running on the device could exploit this flaw to gain elevated system privileges, potentially leading to data theft or broader compromise of the mobile endpoint. With no vendor patch currently available, organizations relying on these devices for business operations face increased risk until mitigations are implemented.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing MDM application allowlisting, restricting sideloading, enabling Google Play Protect, and monitoring for anomalous local privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
GitHub PoC
Exploit-DB