PT-2025-36076 · Unknown · Notificationchannel.Java

Published 2025-09-01 · Updated 2025-09-04 · CVE-2025-48556

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NotificationChannel.java (affected versions not specified)

Description The software contains a potential desynchronization issue stemming from improper input validation in multiple methods of NotificationChannel.java. This could lead to local privilege escalation, requiring no additional execution privileges. User interaction is required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ASB-A-419014146

BDU:2025-11646

CVE-2025-48556

Affected Products

Notificationchannel.Java

References · 10

• https://bdu.fstec.ru/vul/2025-11646 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48556 · Security Note
• https://source.android.com/security/bulletin/2025-09-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-419014146 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/fc5d9b6ef5305263d37404fc3d4afe583a15c62b · Patch
• https://osv.dev/vulnerability/CVE-2025-48556 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/0da1ac9dda567d507bf31d79ec2df68964d3afe9 · Note
• https://android.googlesource.com/platform/frameworks/base/+/717e1b03f4dc024887f5de712a677c047f2f4b14 · Note
• https://twitter.com/CVEnew/status/1963677389411516731 · Twitter Post
• https://t.me/CVEtracker/31721 · Telegram Post