CVE-2025-32313: 
NixOS vulnerability analysis and mitigation

CVE-2025-32313 is a local privilege escalation vulnerability in Android's UsageEvents.java caused by an out-of-bounds write due to an incorrect bounds check. It affects Google Android versions 14.0, 15.0, and 16.0. The vulnerability was published on March 2, 2026, with a patch included in Google's March 2026 Android Security Bulletin (2026-03-01 patch level). It carries a CVSS v3.1 base score of 8.4 (High) (Android Bulletin, Red Hat CVE).

The root cause is an out-of-bounds write (CWE-787) in the UsageEvents class within UsageEvents.java, triggered by an incorrect bounds check during the processing of usage event data. An attacker with local access can exploit this flaw without requiring any additional execution privileges or user interaction, making it a zero-interaction local exploit. The attack vector is local (AV:L), with low complexity, and impacts confidentiality, integrity, and availability at a high level (Android Bulletin).

Successful exploitation allows a local attacker with no special privileges to escalate their privileges on the affected Android device, potentially achieving full device compromise. The vulnerability impacts all three security pillars — confidentiality, integrity, and availability — at a high level, meaning an attacker could access sensitive user data, modify system state, or disrupt device functionality. Affected devices running Android 14, 15, or 16 are at risk (Android Bulletin, Red Hat CVE).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Android Bulletin). The EPSS score is extremely low at approximately 0.006%, reflecting a low near-term exploitation probability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Google has released a patch for CVE-2025-32313 in the March 2026 Android Security Bulletin at the 2026-03-01 patch level. Users and administrators should update affected Android devices (versions 14.0, 15.0, and 16.0) to the latest available security patch as soon as possible. OEM-specific updates (e.g., Samsung, Huawei) incorporating this patch are also being distributed through their respective security update channels (Android Bulletin, CIS Advisory).

The vulnerability was covered as part of broader reporting on Google's March 2026 Android Security Bulletin, which addressed 129 vulnerabilities in total. Security outlets including GBHackers and CyberPress highlighted the bulletin's scope, noting the inclusion of an actively exploited zero-day (separate from this CVE). CIS issued an advisory covering the full bulletin (CIS Advisory, GBHackers).