CVE-2025-36938
Medium · 6.8CVSS
6.8
EPSS
0.1%
Published
Dec 11, 2025
CISA due date
—
The record
In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Android | :unknown: | :0 | :2025-12-05 |
Related vulnerabilities
- CVE-2026-0106 In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing… Also affects :unknown:
- CVE-2025-20791 In Modem, there is a possible system crash due to incorrect error handling. Also affects :unknown:
- CVE-2025-20757 In Modem, there is a possible system crash due to improper input validation. Also affects :unknown:
- CVE-2025-20751 In Modem, there is a possible system crash due to a missing bounds check. Also affects :unknown:
- CVE-2025-20752 In Modem, there is a possible system crash due to a missing bounds check. Also affects :unknown:
- CVE-2025-20750 In Modem, there is a possible system crash due to improper input validation. Also affects :unknown:
- CVE-2025-20756 In Modem, there is a possible system crash due to a logic error. Also affects :unknown:
- CVE-2025-20727 In Modem, there is a possible out of bounds write due to a heap buffer overflow. Also affects :unknown: