PT-2025-43496 · Unknown · Contentprovider.Java

Published 2025-10-23 · Updated 2026-03-06 · CVE-2025-48619

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ContentProvider.java (affected versions not specified)

Description An application with read-only access may be able to truncate files due to a logic error in the code within multiple functions of ContentProvider.java. This could lead to local escalation of privilege without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ASB-A-414387646

CVE-2025-48619

Affected Products

Contentprovider.Java

References · 9

• https://osv.dev/vulnerability/CVE-2025-48619 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-414387646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48619 · Security Note
• https://source.android.com/docs/security/bulletin/2026/2026-03-01 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/base/+/31e77d73c5e6439bc942a92676c4076ebd8295ff · Note
• https://source.android.com/security/bulletin/2026-03-01 · Note
• https://twitter.com/TheHackerWire/status/2028868282850357721 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post
• https://twitter.com/cracbot/status/2029874930356211803 · Twitter Post