CVE-2025-32328: 
NixOS vulnerability analysis and mitigation

CVE-2025-32328 is a local privilege escalation vulnerability in Android's Session.java that allows a low-privileged user to view images belonging to other users on the same device due to a logic error in the code. It affects Android versions 13.0, 14.0, and 15.0. The vulnerability was disclosed on December 8, 2025, with a patch included in the December 2025 Android Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin).

The root cause is a logic error (CWE-840 or similar business logic flaw) in multiple functions within Session.java in the Android framework (platform/frameworks/base). The flaw allows a local attacker with low privileges to bypass user isolation controls and access image data belonging to other device users. No additional execution privileges or user interaction are required for exploitation, making this a straightforward local attack. The patch is available in the Android open-source repository (Android AOSP Patch, Android Security Bulletin).

Successful exploitation allows a low-privileged local attacker to view images belonging to other users on the same Android device, constituting a significant privacy and data exposure risk. The vulnerability has high confidentiality, integrity, and availability impact per its CVSS score, suggesting potential for broader local privilege escalation beyond mere image viewing. Devices running Android 13, 14, and 15 in shared or multi-user configurations are particularly at risk (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is extremely low at 0.000050, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Android Security Bulletin).

Google has released a patch for Android 13.0, 14.0, and 15.0 as part of the December 2025 Android Security Bulletin (patch level 2025-12-01). Users and administrators should apply the December 2025 security update immediately. Additionally, restricting physical and local network access to devices, enforcing strong user authentication, and maintaining up-to-date security patch levels are recommended mitigations (Android Security Bulletin, Android AOSP Patch).

The vulnerability received routine coverage as part of Google's December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. Samsung noted the patch in its October 2025 update coverage, and security aggregators such as BeyondMachines and Hawk-Eye highlighted it in weekly threat digests. No notable independent researcher commentary or significant social media discussion has been identified (Android Security Bulletin).