PT-2025-43493 · Google · Android

CVE-2025-48615 · Published 2025-10-23 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Framework component of Android operating systems due to insufficient input validation. Exploitation of this issue may allow an attacker to escalate privileges. Specifically, a desynchronization in persistence due to resource exhaustion is present in the getComponentName function of MediaButtonReceiverHolder.java. This could lead to local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Allocation of Resources Without Limits

Resource Exhaustion

RCE

Weakness Enumeration

CWE-770

CWE-400

CWE-20

Related Identifiers

BDU:2025-15143

CVE-2025-48615

Affected Products

Android

References · 12

• https://bdu.fstec.ru/vul/2025-15143 · Security Note
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48615 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/a5795fc0cf1f21da88cf05ad06610d3653d1be0e · Patch
• https://osv.dev/vulnerability/CVE-2025-48615 · Vendor Advisory
• https://t.me/cveNotify/165542 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1998218681180971353 · Twitter Post
• https://source.android.com/docs/security/bulletin/2026/2026-06-01 · Note
• https://twitter.com/GrapheneOS/status/2015510661019644403 · Twitter Post
• https://twitter.com/CVEnew/status/1998079574127542700 · Twitter Post
• https://source.android.com/docs/security/bulletin/2025-12-01?hl=ru · Note
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post