Fuchsia Zircon CVE-2025-36940

Exploitation requires low-privileged code execution on the target device - an attacker must already be able to run userspace processes (PR:L per CVSS vector). The vulnerable component is the Zircon kernel pager proxy, which is an inherent part of the Fuchsia kernel architecture and does not require a non-default configuration to be present. No user interaction is required once the attacker has initial code execution. Limiting factors include the need for prior code execution (ruling out purely remote, zero-touch attack chains), the absence of automation per SSVC, and the narrow affected product scope limited to devices running Android F30.1.1 Fuchsia-based firmware. The CVSS AV:N metric conflicts with the local userspace-to-kernel escalation description - if the attack vector is genuinely local, exploitation is further constrained to actors with physical or application-level access to the device.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U) scores 8.8 and warrants scrutiny: AV:N implies the vulnerability is triggerable over a network path, but a userspace-to-kernel UAF in a pager proxy is architecturally a local privilege escalation requiring code execution on the device. This metric inconsistency should be verified with the vendor - the attack vector may reflect a remote initial access assumption rather than the UAF trigger itself. SSVC classifies exploitation as 'none' and automatable as 'no,' which tempers urgency despite the high CVSS score. Technical impact is assessed as 'total,' consistent with full kernel compromise. EPSS data was not provided, but combined with no KEV listing and SSVC exploitation-none, real-world threat activity appears low at time of analysis. Nonetheless, kernel-level compromise on any managed device fleet represents a high-severity lateral-movement and persistence risk, and even a mid-sized municipal IT team in sopot managing Fuchsia-based endpoints should treat patching as a priority given the total technical impact rating. The absence of active exploitation does not diminish the severity of successful exploitation.

An attacker who has obtained low-privileged code execution on a Fuchsia-based device - for example through a malicious application - crafts a sequence of system calls to the Zircon kernel pager proxy that triggers a Use-After-Free condition, freeing a kernel object while retaining a dangling reference. By controlling memory allocation timing (heap grooming), the attacker reclaims the freed memory region with attacker-controlled data, redirecting kernel execution flow to achieve arbitrary code execution at kernel privilege. No public exploit code has been identified at time of analysis, but the full kernel compromise impact makes this a high-value target for motivated actors with device access.