CVE-2025-32319 AI-generated analysis

platform/frameworks/base, services/print (RemotePrintService)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

Removes the flag-gated Context.BIND_INCLUDE_CAPABILITIES term (previously gated by the aconfig flag com.android.server.print.do_not_include_capabilities) from the bindServiceAsUser call in RemotePrintService.ensureBound(), so system_server no longer binds PrintService implementations with BIND_INCLUDE_CAPABILITIES.

Root cause

In services/print/java/com/android/server/print/RemotePrintService.java, ensureBound() bound the print service (mIntent, for mUserId) with mContext.bindServiceAsUser using BIND_AUTO_CREATE | BIND_FOREGROUND_SERVICE | BIND_ALLOW_INSTANT, plus BIND_INCLUDE_CAPABILITIES whenever Flags.doNotIncludeCapabilities() returned false. BIND_INCLUDE_CAPABILITIES makes the bound service inherit the while-in-use capabilities of the binding process (general platform knowledge). Because the binding process here is system_server, the app's PrintService could receive capabilities it does not hold itself. The bulletin rates the issue as a High EoP.

How the fix works

• services/print/java/com/android/server/print/RemotePrintService.java:ensureBound(): deletes the line `| (Flags.doNotIncludeCapabilities() ? 0 : Context.BIND_INCLUDE_CAPABILITIES)` from the bindServiceAsUser flags. The bind flags are now always BIND_AUTO_CREATE | BIND_FOREGROUND_SERVICE | BIND_ALLOW_INSTANT.
• Commit 70ab82c4546a (android-security-16.0.0_r3) is a backport of ag/31156800 (Change-Id I2b9d6b68e7aaa71374a6c5e45796c73a1f3abfa0). The original change was developed behind the aconfig flag and landed in 25Q3. The backport removes the flag dependency instead of flipping the flag, so the fix applies unconditionally.

Completeness

• The fix covers the single bindServiceAsUser call in RemotePrintService.ensureBound(), the only bind site in the diff and its surrounding context. The code at android-security-16.0.0_r8 (lines 573-576) confirms that BIND_INCLUDE_CAPABILITIES is gone.
• The material shows no other bind sites in the print stack, so it cannot tell whether other system_server-to-app bindings there use BIND_INCLUDE_CAPABILITIES.
• On the security branch the removal is unconditional, so the fix works regardless of the aconfig flag state. Per the commit message, the original 25Q3 change was developed behind com.android.server.print.do_not_include_capabilities.

Behavior changes

• Print services bound by system_server are no longer bound with BIND_INCLUDE_CAPABILITIES. A PrintService that relied on inherited while-in-use capabilities (general platform knowledge about this flag) would now be limited to its own capabilities.
• This code path no longer checks Flags.doNotIncludeCapabilities() on the security branch.

Per major

• Android 14: Not affected per the bulletin. At android-security-14.0.0_r29, 4/5 lines of the patched region are present, but the material does not show the actual bind flags on that branch.
• Android 15: Not affected per the bulletin. At android-security-15.0.0_r17, 4/5 lines of the patched region are present, but the material does not show the actual bind flags on that branch.
• Android 16: Resolved by commit 70ab82c4546a in android-security-16.0.0_r3 (backport of ag/31156800, Change-Id I2b9d6b68e7aaa71374a6c5e45796c73a1f3abfa0), which removes the flag-gated BIND_INCLUDE_CAPABILITIES line unconditionally. The code at android-security-16.0.0_r8 confirms the line is absent.
• Android 17: Not affected per the bulletin (not listed). At android-security-17.0.0_r1, 4/5 lines of the patched region are present, but the material does not show the actual bind flags or whether a flag gate remains.

Unknowns

• The material does not show the pre-flag code or the exact bind flags on the 14, 15 and 17 security branches, only that the bulletin does not list them.
• The default state of the aconfig flag com.android.server.print.do_not_include_capabilities is not shown.
• The material does not show which concrete capabilities a bound PrintService could obtain, or the exact scenario behind the High EoP rating.
• How print services are enabled or selected before RemotePrintService binds them is not shown.
• Whether other print-related bind sites use BIND_INCLUDE_CAPABILITIES is not shown.

Back to December 2025 · Findings