PT-2026-24398 · Google · Google Pixel

Canyie · Published 2026-03-10 · Updated 2026-03-10 · CVE-2025-48611

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Pixel (affected versions not specified)

Description The issue involves a potential desynchronization in persistence due to a missing bounds check within the DeviceId component. This could allow for local escalation of privilege without requiring additional execution privileges or user interaction. The affected component is located at the following API endpoint: https://t.co/KGwrw2z7cn. The vulnerability resides in the DeviceId component, specifically related to a missing bounds check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-48611

Affected Products

Google Pixel

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-48611 · Security Note
• https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 · Vendor Advisory
• https://twitter.com/0dayPublishing/status/2031458571179663591 · Twitter Post
• https://twitter.com/TheHackerWire/status/2031471178284708022 · Twitter Post
• https://twitter.com/vuldb/status/2031510211090096308 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031505677798052161 · Twitter Post
• https://twitter.com/CVEnew/status/2031504144440127583 · Twitter Post
• https://twitter.com/CveFindCom/status/2031470479735718039 · Twitter Post
• https://twitter.com/ptdbugs/status/2031467327003214242 · Twitter Post