CVE-2025-32320: 
NixOS vulnerability analysis and mitigation

In Android 16, there is a vulnerability (CVE-2025-32320) that allows local escalation of privilege with no additional execution privileges needed. The vulnerability was discovered in September 2025 and affects Android operating system version 16. The issue is related to a confused deputy vulnerability in the System UI component that potentially allows viewing of other users' images (AttackerKB).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (High), with an attack vector that is Local (L), low attack complexity (L), low privileges required (L), and no user interaction needed (N). The vulnerability impacts confidentiality, integrity, and availability at high levels (H,H,H) with unchanged scope (AttackerKB).

The vulnerability allows an attacker to view other users' images through the System UI, potentially leading to unauthorized access to sensitive information. The impact is significant as it requires no additional execution privileges and can be exploited without user interaction (AttackerKB).