PT-2025-35935 · Android · Android

Published 2025-09-01 · Updated 2025-11-16 · CVE-2025-48539

Positive Technologies · (AI Summary)

CVSS v3.1

8.0

High

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The issue is a critical zero-click Remote Code Execution (RCE) flaw that allows attackers to hijack Android devices via Wi-Fi or Bluetooth without any user interaction. Exploitation can occur with no additional execution privileges needed and within physical or network proximity. Successful exploitation could lead to full device access remotely through privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

LPE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ASB-A-406785684

BDU:2025-10997

CVE-2025-48539

Affected Products

Android

References · 28

• https://bdu.fstec.ru/vul/2025-10997 · Security Note
• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-406785684 · Vendor Advisory
• https://android.googlesource.com/platform/packages/modules/Bluetooth/+/c881220f499edcbdff9a7efdf00beeaeba084245 · Patch
• https://osv.dev/vulnerability/CVE-2025-48539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48539 · Security Note
• https://t.me/cKure/16286 · Telegram Post
• https://t.me/CVEtracker/31705 · Telegram Post
• https://twitter.com/hkashfi/status/1963513050817765558 · Twitter Post
• https://t.me/ckuRED/651 · Telegram Post
• https://twitter.com/GunsandAntidote/status/1964019158250598417 · Twitter Post
• https://android.googlesource.com/platform/packages/modules/Bluetooth/+/33be5d45cb275aa9c13d975a4c556b2e7a769089 · Note
• https://reddit.com/r/CVEWatch/comments/1n91705/top_10_trending_cves_05092025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1n9vszk/top_10_trending_cves_06092025 · Reddit Post
• https://twitter.com/xvonfers/status/1966106744267977054 · Twitter Post