{"id":"CVE-2025-36911","aliases":["A-445196906","EUVD-2026-2722","GHSA-6fxf-xg6m-34hj","PUB-A-445196906"],"status":"published","title":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to...","description":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.08411,"percentile":0.95033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2026-01-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","exploits":[{"source":"pocgithub","id":"Cedric-Martz/CVE-2025-36911_scan","title":"Cedric-Martz/CVE-2025-36911_scan","date":"2026-01-17","url":"https://github.com/Cedric-Martz/CVE-2025-36911_scan"},{"source":"pocgithub","id":"SpectrixDev/DIY_WhisperPair","title":"SpectrixDev/DIY_WhisperPair","date":"2026-01-17","url":"https://github.com/SpectrixDev/DIY_WhisperPair"},{"source":"pocgithub","id":"SteamPunk424/CVE-2025-36911-Wisper_Pair_Target_Finder","title":"SteamPunk424/CVE-2025-36911-Wisper_Pair_Target_Finder","date":"2026-01-17","url":"https://github.com/SteamPunk424/CVE-2025-36911-Wisper_Pair_Target_Finder"},{"source":"pocgithub","id":"zalexdev/wpair-app","title":"zalexdev/wpair-app","date":"2026-01-17","url":"https://github.com/zalexdev/wpair-app"},{"source":"pocgithub","id":"markmysler/wpair-cli","title":"markmysler/wpair-cli","date":"2026-01-19","url":"https://github.com/markmysler/wpair-cli"},{"source":"pocgithub","id":"PivotChip/FrostedFastPair","title":"PivotChip/FrostedFastPair","date":"2026-01-20","url":"https://github.com/PivotChip/FrostedFastPair"},{"source":"pocgithub","id":"ap425q/whisper-pair","title":"ap425q/whisper-pair","date":"2026-01-21","url":"https://github.com/ap425q/whisper-pair"},{"source":"pocgithub","id":"aalex954/whisperpair-poc-tool","title":"aalex954/whisperpair-poc-tool","date":"2026-01-25","url":"https://github.com/aalex954/whisperpair-poc-tool"},{"source":"pocgithub","id":"PentHertz/CVE-2025-36911-exploit","title":"PentHertz/CVE-2025-36911-exploit","date":"2026-01-27","url":"https://github.com/PentHertz/CVE-2025-36911-exploit"},{"source":"pocgithub","id":"KULeuven-COSIC/WhisperPair","title":"KULeuven-COSIC/WhisperPair","date":"2026-03-30","url":"https://github.com/KULeuven-COSIC/WhisperPair"},{"source":"pocgithub","id":"Ymsniper/Whisper_Bully","title":"Ymsniper/Whisper_Bully","date":"2026-07-07","url":"https://github.com/Ymsniper/Whisper_Bully"}],"fixes":[{"ecosystem":"Android","package":":unknown:","fixed_in":["Pixel-family specific:2026-01-05"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":unknown:","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"Pixel-family specific:0"},{"fixed":"Pixel-family specific:2026-01-05"}]}],"versions":["Pixel-family specific"]}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-01-01","tags":["vendor-advisory"]},{"url":"https://whisperpair.eu/","tags":["third-party-advisory","Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36911"},{"url":"https://source.android.com/security/bulletin/pixel/2026-01-01"},{"url":"https://whisperpair.eu"},{"url":"https://github.com/advisories/GHSA-6fxf-xg6m-34hj"},{"url":"https://source.android.com/security/bulletin/2026-01-01","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-36911","description":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-01-15T17:41:57.504Z","modified":"2026-01-28T04:55:59.423Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2026-2722","description":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-01-15T17:41:57Z","modified":"2026-01-28T04:55:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:46.416428Z"}],"ghsa":[{"id":"GHSA-6fxf-xg6m-34hj","title":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to...","description":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-01-15T18:31:33Z","modified":"2026-01-28T06:31:36Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:05:57.071513Z"}],"nvd":[{"id":"CVE-2025-36911","description":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-01-15T18:16:37.193Z","modified":"2026-06-17T09:14:59.087Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"PUB-A-445196906","description":"In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-01-01T00:00:00Z","modified":"2026-11-09T16:40:10.884737887Z","updated_at":"2026-11-09T17:05:56.917158Z"}]}}