Tachyon Server Vulnerability

The Tachyon Server is a component of the Android Open Source Project (AOSP), responsible for serving files to devices. This vulnerability allows an attacker to execute arbitrary code on the device with no additional privileges, making it a critical security issue.

Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

To fix this vulnerability, update your Android build to use android-latest-release instead of aosp-main. For more information, see the AOSP Security documentation and the Pixel Update Bulletin—December 2025.

Immediate mitigations:

• Restrict network access to your Tachyon Server instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized command execution

• Vendor Advisory