PT-2025-49014 · Google · Android

Published 2025-12-01 · Updated 2025-12-08 · CVE-2025-48591

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android (affected versions not specified)

Description A flaw exists in the Android Framework component due to insufficient protection of system data. This could allow an attacker to disclose protected information. The issue involves a missing permission check in multiple locations, potentially allowing unauthorized reading of files belonging to other users. Exploitation does not require additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

ASB-A-305710469

BDU:2025-15130

CVE-2025-48591

Affected Products

Android

References · 9

• https://bdu.fstec.ru/vul/2025-15130 · Security Note
• https://osv.dev/vulnerability/ASB-A-305710469 · Vendor Advisory
• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48591 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48591 · Security Note
• https://source.android.com/docs/security/bulletin/2025-12-01?hl=ru · Note
• https://android.googlesource.com/platform/frameworks/base/+/3df02a7df8488e04e31ae1d9d081ed1b881dd6ad · Note
• https://android.googlesource.com/platform/packages/services/Mms/+/43ca1053f0a09b6fd1503caaecb62967a497b554 · Note
• https://twitter.com/CVEnew/status/1998079588581192160 · Twitter Post