PT-2025-36066 · Unknown · Accountmanagerservice

Published 2025-09-01 · Updated 2026-03-04 · CVE-2025-48545

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions AccountManagerService (affected versions not specified)

Description An application may access privileged APIs due to a confused deputy condition within the isSystemUid function of AccountManagerService.java. This could result in local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-441

Related Identifiers

ASB-A-397438392

BDU:2025-11686

CVE-2025-48545

Affected Products

Accountmanagerservice

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-48545 · Security Note
• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/66ac17909252c80b0edf7f4ae282bce4579410ad · Patch
• https://osv.dev/vulnerability/CVE-2025-48545 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-397438392 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11686 · Security Note
• https://twitter.com/CVEnew/status/1963677401331695812 · Twitter Post
• https://android.googlesource.com/platform/frameworks/base/+/3eb6e9bf403d4b42762f15f55875cbb75039edea · Note
• https://t.me/CVEtracker/31711 · Telegram Post
• https://t.me/cveNotify/154110 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/c21f79312d3f22d854ddf4d1fd613fdae7cd182f · Note