PT-2025-43501 · Google · Android

Published 2025-10-23 · Updated 2025-12-09 · CVE-2025-48628

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Framework component of Android operating systems related to insufficient protection of sensitive data. Exploitation may allow an attacker to disclose protected information. Specifically, the issue resides in the validateIconUserBoundary function within PrintManagerService.java, potentially leading to a cross-user image leak due to a confused deputy condition. This could result in local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Information Disclosure

Weakness Enumeration

CWE-200

CWE-441

Related Identifiers

ASB-A-376462130

BDU:2025-15142

CVE-2025-48628

Affected Products

Android

References · 10

• https://bdu.fstec.ru/vul/2025-15142 · Security Note
• https://android.googlesource.com/platform/frameworks/base/+/9489a5dcd3cdd426d5b39d9caf6bb78142af2399 · Patch
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-376462130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48628 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48628 · Vendor Advisory
• https://source.android.com/docs/security/bulletin/2025-12-01?hl=ru · Note
• https://twitter.com/VulmonFeeds/status/1998203322256244794 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post
• https://twitter.com/CVEnew/status/1998079563880858071 · Twitter Post