CVE-2025-26427

In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Score

CVSS 3.1 4.4 Medium

Status

Analyzed - security@android.com

Published

2025-09-04

Last modified

2026-02-26

Weaknesses

CWE-24

Affected products

• Android (Google)

References

• https://android.googlesource.com/platform/frameworks/base/+/4af5db76f25348849252e0b8a08f4a517ef842b7
• https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/5acd646e0cf63e2c9c0862da7e03531ef0074394
• https://source.android.com/security/bulletin/2025-05-01