PT-2025-36059 · Unknown · Apprestrictionsfragment

Published 2025-09-01 · Updated 2025-09-04 · CVE-2025-48535

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025-48535

Description A parcel mismatch in assertSafeToStartCustomActivity of AppRestrictionsFragment.java may lead to a launch anywhere vulnerability due to unsafe deserialization. This could result in local escalation of privilege without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

ASB-A-353680402

BDU:2025-11609

CVE-2025-48535

Affected Products

Apprestrictionsfragment

References · 10

• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/Settings/+/1e4423730f8776bd09df7614474643ae735d2176 · Patch
• https://osv.dev/vulnerability/ASB-A-353680402 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11609 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48535 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48535 · Vendor Advisory
• https://source.android.com/security/bulletin/wear/2025-09-01 · Note
• https://android.googlesource.com/platform/packages/apps/Settings/+/d8166274a030372f9b1184137fceef9d4dac83e1 · Note
• https://android.googlesource.com/platform/packages/apps/Settings/+/25ed933c4cf5acb7a15c146332f9586f3dd1abe0 · Note
• https://twitter.com/CVEnew/status/1963677411549036700 · Twitter Post