PT-2025-43493 · Google · Android

Published 2025-10-23 · Updated 2026-01-25 · CVE-2025-48615

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. Exploitation of this issue may allow an attacker to escalate privileges. Specifically, a desynchronization in persistence due to resource exhaustion is present in the getComponentName function of MediaButtonReceiverHolder.java. This could lead to local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Resource Exhaustion

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-400

CWE-770

CWE-20

Related Identifiers

BDU:2025-15143

CVE-2025-48615

Affected Products

Android

References · 10

• https://osv.dev/vulnerability/CVE-2025-48615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48615 · Security Note
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15143 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/a5795fc0cf1f21da88cf05ad06610d3653d1be0e · Patch
• https://twitter.com/VulmonFeeds/status/1998218681180971353 · Twitter Post
• https://source.android.com/docs/security/bulletin/2025-12-01?hl=ru · Note
• https://twitter.com/GrapheneOS/status/2015510661019644403 · Twitter Post
• https://twitter.com/CVEnew/status/1998079574127542700 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post