CVE-2025-52926: 
Rust vulnerability analysis and mitigation

CVE-2025-52926 is an omission of security-relevant information vulnerability in spytrap-adb, an open-source Android stalkerware detection tool. In scan.rs, stalkerware rule matches detected during a scan were not passed to the interactive terminal user interface (TUI), meaning users relying on the TUI would receive no visual indication of detected stalkerware even when it was present. All versions before 0.3.5 are affected. The vulnerability was discovered by contributor Sylnachten, disclosed and patched on June 21, 2025, and assigned CVE-2025-52926 on June 23, 2025. It carries a CVSS v3.1 base score of 2.7 (Low) (Github Advisory, spytrap-adb v0.3.5 Release).

The root cause is classified as CWE-223 (Omission of Security-relevant Information). In src/scan.rs, when the scanner matched a package against known stalkerware rules and generated a high-suspicion alert, the resulting Suspicion object was logged via a warn! macro but was never passed to the report.app() function that populates the TUI. The fix (commit 277cec5) adds 9 lines to correctly forward the Suspicion { level: SuspicionLevel::High, description: alert } struct to the reporting pipeline so it is rendered in the interactive interface. Exploitation requires local access and user interaction (running the tool), and the scope change reflects that the affected component — the user's awareness of stalkerware — extends beyond the tool itself (PR #65, Commit 277cec5).

The primary impact is an integrity loss in the form of false assurance: users scanning a device via the TUI would see no stalkerware alerts even when stalkerware was detected, potentially leading them to conclude a device is clean when it is not. This could result in victims of stalkerware remaining unaware of ongoing surveillance or privacy invasion on their Android devices. There is no direct confidentiality or availability impact, and no lateral movement risk, but the real-world consequence for abuse survivors or at-risk individuals relying on this tool could be significant (Github Advisory, spytrap-adb v0.3.5 Release).

There is no known public proof-of-concept exploit, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The nature of this vulnerability is a UI rendering omission rather than a remotely triggerable flaw, making active exploitation in the traditional sense not applicable (Github Advisory, Feedly).

Users should upgrade spytrap-adb to version 0.3.5 or later, which includes the fix for this issue. The patched release is available at the official GitHub repository. No configuration-based workaround exists for versions prior to 0.3.5; however, users on affected versions can use the scan subcommand output (which did correctly list stalkerware matches) rather than the interactive TUI as a temporary measure. After upgrading, verify that stalkerware detection matches are correctly displayed in the TUI (spytrap-adb v0.3.5 Release, Github Advisory).

The project maintainer (kpcyrd) described the issue as "pretty bad" upon discovery and promptly merged the fix and issued a new release, characterizing it as an "urgent fix" in the release notes. The fix was contributed by a new contributor (Sylnachten) who discovered the rendering omission. The release notes explicitly note that stalkerware matches were listed by the scan subcommand but not shown in the interactive interface, which is how most users interact with the tool (PR #65, spytrap-adb v0.3.5 Release).