PT-2025-43479 · Google · Android

Published 2025-10-23 · Updated 2025-12-08 · CVE-2025-48592

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Framework component of Android operating systems related to insufficient protection of service data. Exploitation of this issue may allow an attacker to disclose protected information. A potential out-of-bounds read exists due to a heap buffer overflow within the initDecoder function of C2SoftDav1dDec.cpp, which could lead to remote information disclosure without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Information Disclosure

Heap Based Buffer Overflow

Weakness Enumeration

CWE-125

CWE-200

CWE-122

Related Identifiers

ASB-A-427113482

BDU:2025-15140

CVE-2025-48592

Affected Products

Android

References · 9

• https://osv.dev/vulnerability/ASB-A-427113482 · Vendor Advisory
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/av/+/8febdebcb5e8736ec013a7d64e70f50e87649b52 · Patch
• https://osv.dev/vulnerability/CVE-2025-48592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48592 · Security Note
• https://bdu.fstec.ru/vul/2025-15140 · Security Note
• https://source.android.com/docs/security/bulletin/2025-12-01?hl=ru · Note
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post
• https://twitter.com/CVEnew/status/1998079587629109718 · Twitter Post