{"id":"ASB-A-399155883","details":"In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-399155883","CVE-2025-32313"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/59c15187e7ee299592c22a166528fb27b3a03867"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["231669923599031773957039180515541152852","223511055771042946164426902988612866567","271051517406961531774645090058406933735","145313611837164842715774235478631325715"]},"exact_target_file_match_only":true,"id":"ASB-A-399155883-71ee7cf6","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd4045126ff01cec3d65c053a0c2c01dc231a0f5","target":{"file":"core/java/android/app/NotificationHistory.java"}},{"target":{"function":"NotificationHistory","file":"core/java/android/app/NotificationHistory.java"},"deprecated":false,"digest":{"length":567,"function_hash":"199873608067464997638907624459687258057"},"id":"ASB-A-399155883-d6ca5934","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd4045126ff01cec3d65c053a0c2c01dc231a0f5"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fd4045126ff01cec3d65c053a0c2c01dc231a0f5"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-399155883.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/611b730bade54a0a79dbcc3087d9393086e6dbdf","target":{"function":"Parcel::appendFrom","file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"function_hash":"152238049641040340065809283766155818287","length":4323},"id":"ASB-A-399155883-054321d8","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/611b730bade54a0a79dbcc3087d9393086e6dbdf","target":{"file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"line_hashes":["128876208758306181662005595789290678392","276958250673630700514648713496450364166","130802152778488338459126135897087928956","189262720058320133529245993440674487221"],"threshold":0.9},"id":"ASB-A-399155883-6e12e841"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/611b730bade54a0a79dbcc3087d9393086e6dbdf"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-399155883.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/02c31e68b06c4adbe87608b631aa9e8454e958d7","target":{"file":"core/java/android/app/NotificationHistory.java"},"deprecated":false,"digest":{"line_hashes":["231669923599031773957039180515541152852","223511055771042946164426902988612866567","271051517406961531774645090058406933735","145313611837164842715774235478631325715"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-399155883-46c3da18","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/02c31e68b06c4adbe87608b631aa9e8454e958d7","target":{"file":"core/java/android/app/NotificationHistory.java","function":"NotificationHistory"},"deprecated":false,"digest":{"function_hash":"199873608067464997638907624459687258057","length":567},"id":"ASB-A-399155883-66f1621c","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/02c31e68b06c4adbe87608b631aa9e8454e958d7"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-399155883.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"length":4291,"function_hash":"265963880888532221123827951973503122979"},"id":"ASB-A-399155883-2233c73b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/fa5cdb65cb1dcd02da88d3c63869be9a346ef13f","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::appendFrom"}},{"deprecated":false,"digest":{"line_hashes":["128876208758306181662005595789290678392","276958250673630700514648713496450364166","130802152778488338459126135897087928956","189262720058320133529245993440674487221"],"threshold":0.9},"id":"ASB-A-399155883-ce1e9d7b","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/fa5cdb65cb1dcd02da88d3c63869be9a346ef13f","target":{"file":"libs/binder/Parcel.cpp"}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/fa5cdb65cb1dcd02da88d3c63869be9a346ef13f"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-399155883.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/27e0f2b515ca65729a84999e792cf7e8240025a9"],"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/27e0f2b515ca65729a84999e792cf7e8240025a9","target":{"file":"core/java/android/app/NotificationHistory.java","function":"NotificationHistory"},"deprecated":false,"digest":{"function_hash":"199873608067464997638907624459687258057","length":567},"id":"ASB-A-399155883-7df52d9d","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["231669923599031773957039180515541152852","223511055771042946164426902988612866567","271051517406961531774645090058406933735","145313611837164842715774235478631325715"],"threshold":0.9},"exact_target_file_match_only":true,"id":"ASB-A-399155883-ab16c8c9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/27e0f2b515ca65729a84999e792cf7e8240025a9","target":{"file":"core/java/android/app/NotificationHistory.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-399155883.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-399155883-6e2ecb0e","match_only_versions":["14"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/97c957a01a563b96438c4ea5c66c23bdfa4553ef","target":{"file":"core/java/android/app/NotificationHistory.java"},"deprecated":false,"digest":{"line_hashes":["231669923599031773957039180515541152852","223511055771042946164426902988612866567","271051517406961531774645090058406933735","145313611837164842715774235478631325715"],"threshold":0.9}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/97c957a01a563b96438c4ea5c66c23bdfa4553ef","target":{"file":"core/java/android/app/NotificationHistory.java","function":"NotificationHistory"},"deprecated":false,"digest":{"length":567,"function_hash":"199873608067464997638907624459687258057"},"id":"ASB-A-399155883-9557c56a","signature_type":"Function"},{"target":{"function":"UsageEvents","file":"core/java/android/app/usage/UsageEvents.java"},"deprecated":false,"digest":{"function_hash":"223825755557320171149696409666820322929","length":590},"id":"ASB-A-399155883-9a2ab2c2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/715cf1915f7ca85e41cdaa86d0c8bfa8d2dedd9a"},{"deprecated":false,"digest":{"line_hashes":["231669923599031773957039180515541152852","223511055771042946164426902988612866567","271051517406961531774645090058406933735","12711383867317412997152352821393009446"],"threshold":0.9},"id":"ASB-A-399155883-ea8bd5d9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/715cf1915f7ca85e41cdaa86d0c8bfa8d2dedd9a","target":{"file":"core/java/android/app/usage/UsageEvents.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/97c957a01a563b96438c4ea5c66c23bdfa4553ef","https://android.googlesource.com/platform/frameworks/base/+/715cf1915f7ca85e41cdaa86d0c8bfa8d2dedd9a"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-399155883.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/native/+/5a247775d486c997f49b900477b8fd1c3eaba263","target":{"file":"libs/binder/Parcel.cpp","function":"Parcel::appendFrom"},"deprecated":false,"digest":{"function_hash":"132039570239997110659881197461721517994","length":4267},"id":"ASB-A-399155883-31be2351","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/5a247775d486c997f49b900477b8fd1c3eaba263","target":{"file":"libs/binder/Parcel.cpp"},"deprecated":false,"digest":{"line_hashes":["128876208758306181662005595789290678392","276958250673630700514648713496450364166","130802152778488338459126135897087928956","189262720058320133529245993440674487221"],"threshold":0.9},"id":"ASB-A-399155883-a10f2406"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/5a247775d486c997f49b900477b8fd1c3eaba263"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-399155883.json"}}],"schema_version":"1.9.0"}