CVE-2025-36937 is a Critical flaw, CVSS 9.8, in AudioDecoder::HandleProduceRequest in the Android audio_decoder.cc code, with an out-of-bounds write from an incorrect bounds check. The Pixel December 2025 bulletin fixes it. Devices on security patch level 2025-12-05 or later are covered.
What's affected
The record lists Google Android. The Pixel Update Bulletin for December 2025 lists CVE-2025-36937 with the type RCE and the subcomponent AOC, and rates it High in its own table. The NVD style score in the record is 9.8 Critical, so you will see both labels in different tools.
The bulletin says that security patch levels of 2025-12-05 or later address all issues in that bulletin and in the December 2025 Android Security Bulletin. It states that all supported Google devices will receive an update to the 2025-12-05 patch level. Other Android makers publish their own schedules, so check your device vendor.
How to check if you're exposed
On a Pixel, open Settings, then About phone, then Android version, and read the Android security update date. You want 2025-12-05 or later. For a fleet, read the security patch level from your mobile device management console.
For non Pixel devices, check the vendor's own security bulletin for this CVE, since patch levels and shipping dates differ between manufacturers.
What to do now
- Update Pixel devices to the December 2025 update or later and confirm the security patch level is 2025-12-05 or newer.
- For other Android devices, find the vendor bulletin that lists CVE-2025-36937 and apply it.
- In managed fleets, set a compliance rule that flags devices with a patch level older than 2025-12-05.
- Retire devices that no longer receive security updates, since they cannot be fixed.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). The audio decoder checks a size or range incorrectly, so it can write data beyond the end of a buffer. Memory writes outside a buffer can overwrite neighbouring data and, in the worst case, redirect program execution. The bulletin lists the impact as remote code execution.
The record's vector is network, low complexity, no privileges and no user interaction, which is the reason for the 9.8 score. The description says no additional execution privileges are needed and user interaction is not needed. The record does not mark the CVE as exploited, and the bulletin text I read does not say it is.
The lesson is old but still true. Media parsing and decoding code runs on untrusted input and is a regular source of memory safety bugs, so update promptly even when a vendor rates it High.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which patch level fixes it?
The Pixel bulletin says patch level 2025-12-05 or later addresses this issue and the rest of the bulletin.
Why is it High in the bulletin and Critical in the record?
The Android bulletin uses its own severity scale. The record carries a CVSS 9.8 score. Both point to a prompt update.
Sources
Last reviewed: 18 October 2026.
