EUVD-2025-210765
GHSA-c8m2-hm25-9jf6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
UAF exploitation requires local code execution and heap grooming (AC:H); crossing userspace-to-kernel boundary constitutes scope change (S:C); PR:L reflects required initial access.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)
AnalysisAI
Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.
Technical ContextAI
The Zircon microkernel is the foundation of Google's Fuchsia operating system. The pager proxy is a kernel-space component that mediates on-demand page population between userspace pager services and the kernel's virtual memory subsystem. CWE-416 (Use-After-Free) describes a class of memory corruption flaw where a program continues to use a pointer after the memory it references has been freed, allowing an attacker to control the freed memory region and redirect execution or corrupt kernel state. In Fuchsia's architecture, the pager proxy handles privileged kernel objects; a UAF here allows a userspace actor to corrupt kernel memory structures with attacker-controlled data. The CPE string cpe:2.3:a:google:android:*:*:*:*:*:*:*:* combined with the affected version 'Android F30.1.1' suggests this issue surfaces in a Google product line where Fuchsia's Zircon kernel underpins the platform (e.g., smart display or embedded Android-adjacent products). The 'AP' annotation in the description denotes Application-to-Privileged escalation direction.
RemediationAI
The primary remediation is to apply the vendor-released fix documented in the Google product security advisory at https://support.google.com/product-documentation/answer/17072818. Affected Android F30.1.1 devices should be updated to the patched firmware version referenced in that advisory; the exact fixed release version was not independently confirmed from the available input data. As a compensating control where immediate patching is not feasible, restricting physical and network access to affected devices reduces the attack surface, since exploitation requires attaining low-privileged code execution on the device first. Disabling or restricting userspace pager-backed VMO usage, if supported by the platform's security policy, may reduce exposure but could affect functionality and is not confirmed as an official workaround. Monitor the Google advisory page for updated patch version details.
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today