PT-2025-43475 · Unknown · Editfdncontactscreen.Java

Published 2025-10-23 · Updated 2025-12-08 · CVE-2025-48586

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025-48586

Description A flaw exists in the handling of onActivityResult within EditFdnContactScreen.java that may allow for the leakage of contacts from the work profile. This issue is due to a confused deputy condition and could result in local privilege escalation without requiring additional execution privileges or user interaction. The vulnerability resides in the processing of results from an activity, potentially allowing unauthorized access to contact information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-441

Related Identifiers

ASB-A-337784859

CVE-2025-48586

Affected Products

Editfdncontactscreen.Java

References · 7

• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-337784859 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48586 · Vendor Advisory
• https://android.googlesource.com/platform/packages/services/Telephony/+/851fc787e96189a37f88cb9eaa688087883357c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-48586 · Security Note
• https://twitter.com/CVEnew/status/1998079592624468469 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post