ASB-A-291281543

See a problem?
Import Source
https://storage.googleapis.com/android-osv/ASB-A-291281543.json
JSON Data
https://api.osv.dev/v1/vulns/ASB-A-291281543
Aliases
  • A-291281543
  • CVE-2025-32319
Published
2025-12-01T00:00:00Z
Modified
2025-12-05T17:11:36.217888Z
Summary
[none]
Details

In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.

References

Affected packages

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-12-01

Affected versions

Other

16-next

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/35f00436f25c39813d2927bc58486703a753d1ec",
        "https://android.googlesource.com/platform/frameworks/base/+/808e070acf5678086706c62fb876c63fb00303cd",
        "https://android.googlesource.com/platform/frameworks/base/+/9f62ea1bb5c396e9b39687da99581ebff237a8e4"
    ],
    "vanir_signatures": [
        {
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "digest": {
                "line_hashes": [
                    "276175483918703643267763319727672269636",
                    "114195431026456258179721833469482479710",
                    "296396136293484807404839773138533120864",
                    "82121813933857842291480403617967861462"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9f62ea1bb5c396e9b39687da99581ebff237a8e4",
            "deprecated": false,
            "id": "ASB-A-291281543-7c98f0cf",
            "signature_type": "Line"
        },
        {
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "digest": {
                "line_hashes": [
                    "93299813471410581969135562935949905153",
                    "15472191267997321310275476709132526577",
                    "331422874673880489244790870663492104578",
                    "33723722171494134271822092619579944937"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/35f00436f25c39813d2927bc58486703a753d1ec",
            "signature_type": "Line",
            "match_only_versions": [
                "16-next"
            ],
            "deprecated": false,
            "id": "ASB-A-291281543-7f65acbe"
        },
        {
            "target": {
                "function": "ensureBound",
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "digest": {
                "length": 583.0,
                "function_hash": "284769961671316759783773943984793267599"
            },
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/35f00436f25c39813d2927bc58486703a753d1ec",
            "signature_type": "Function",
            "match_only_versions": [
                "16-next"
            ],
            "deprecated": false,
            "id": "ASB-A-291281543-b48606c7"
        },
        {
            "target": {
                "function": "ensureBound",
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "digest": {
                "length": 614.0,
                "function_hash": "207560831244109959545212607114023295396"
            },
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/9f62ea1bb5c396e9b39687da99581ebff237a8e4",
            "deprecated": false,
            "id": "ASB-A-291281543-dc565d9e",
            "signature_type": "Function"
        }
    ]
}

Android / platform/vendor/google_shared/build/release

Package

Name
platform/vendor/google_shared/build/release

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16-next:0
Fixed
16-next:2025-12-01

Affected versions

Other

16-next

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/vendor/google_shared/build/release/+/1759abed172b1f1ee3e5ed65739914f314b60943"
    ]
}

Android / platform/frameworks/base

Package

Name
platform/frameworks/base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
16:0
Fixed
16:2025-12-01

Affected versions

Other

16

Ecosystem specific 

{
    "spl": "2025-12-01",
    "severity": "High",
    "types": [
        "EoP"
    ],
    "fixes": [
        "https://android.googlesource.com/platform/frameworks/base/+/96d05a62683b53f6ba9c83ae43f40f119cd6115b"
    ],
    "vanir_signatures": [
        {
            "target": {
                "function": "ensureBound",
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "digest": {
                "length": 614.0,
                "function_hash": "207560831244109959545212607114023295396"
            },
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/96d05a62683b53f6ba9c83ae43f40f119cd6115b",
            "deprecated": false,
            "id": "ASB-A-291281543-30827104",
            "signature_type": "Function"
        },
        {
            "target": {
                "file": "services/print/java/com/android/server/print/RemotePrintService.java"
            },
            "digest": {
                "line_hashes": [
                    "276175483918703643267763319727672269636",
                    "114195431026456258179721833469482479710",
                    "296396136293484807404839773138533120864",
                    "82121813933857842291480403617967861462"
                ],
                "threshold": 0.9
            },
            "signature_version": "v1",
            "source": "https://android.googlesource.com/platform/frameworks/base/+/96d05a62683b53f6ba9c83ae43f40f119cd6115b",
            "deprecated": false,
            "id": "ASB-A-291281543-cd981f5f",
            "signature_type": "Line"
        }
    ]
}