PT-2026-22669 · Google · Android+1

Published 2026-03-01 · Updated 2026-03-03 · CVE-2025-48650

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions (affected versions not specified)

Description There is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege without requiring additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ASB-A-388530367

CVE-2025-48650

Affected Products

Android

Platform/Packages/Providers/Telephonyprovider

References · 8

• https://source.android.com/docs/security/bulletin/2026/2026-03-01 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-388530367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48650 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48650 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2028754866861211985 · Twitter Post
• https://t.me/cveNotify/153916 · Telegram Post
• https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0d45a6a15770ca3ec5d0d2264983c057aae41939 · Note
• https://source.android.com/security/bulletin/2026-03-01 · Note