PT-2025-43502 · Google · Android

Published 2025-10-23 · Updated 2025-12-09 · CVE-2025-48629

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the VoiceInteractionManagerService.java component, specifically within the findAvailRecognizer function. This issue stems from an insecure default value, potentially allowing an attacker to become the default speech recognizer application. Successful exploitation could lead to local privilege escalation without requiring additional execution privileges or user interaction. The vulnerability is related to insufficient input validation within the Android Framework component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

RCE

Weakness Enumeration

CWE-1188

CWE-20

Related Identifiers

ASB-A-352518318

BDU:2025-15148

CVE-2025-48629

Affected Products

Android

References · 9

• https://osv.dev/vulnerability/ASB-A-352518318 · Vendor Advisory
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48629 · Security Note
• https://bdu.fstec.ru/vul/2025-15148 · Security Note
• https://source.android.com/docs/security/bulletin/2025-12-01?hl=ru · Note
• https://twitter.com/VulmonFeeds/status/1998211001603223968 · Twitter Post
• https://twitter.com/CVEnew/status/1998079562949751246 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post