PT-2025-48941 · Android · Android

Published 2025-08-28 · Updated 2025-12-08 · CVE-2025-48637

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description The Android operating system’s pKVM (protected Kernel-based Virtual Machine) virtualization technology contains synchronization errors when adding pages to the memory cache, resulting in a race condition. Exploitation may allow an attacker to gain elevated privileges. Multiple functions within mem protect.c are susceptible to an out-of-bounds write condition caused by an integer overflow, potentially leading to local privilege escalation without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Time Of Check To Time Of Use

Race Condition

Weakness Enumeration

CWE-190

CWE-367

CWE-362

Related Identifiers

BDU:2025-15116

CVE-2025-48637

Affected Products

Android

References · 8

• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48637 · Security Note
• https://bdu.fstec.ru/vul/2025-15116 · Security Note
• https://android.googlesource.com/kernel/common/+/aff2255dbe38dc7c57bac8d3ba9feed989289b20 · Note
• https://twitter.com/CVEnew/status/1998079558763835673 · Twitter Post
• https://android.googlesource.com/kernel/common/+/4cfc9c2d8815577832cafbfcd7f98025f0da718d · Note
• https://source.android.com/docs/security/bulletin/2025-12-01 · Note
• https://t.me/CVEtracker/39134 · Telegram Post