CVE-2025-48595
Android Framework Integer Overflow Vulnerability
Description
CVE-2025-48595 is an integer overflow vulnerability in the Android Framework that affects Google Android 14.0, 15.0, and 16.0. By triggering an arithmetic operation that overflows the integer type, a local attacker can achieve code execution and local escalation of privilege without needing any additional execution privileges and without any user interaction. The flaw matters because CVE-2025-48595 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and carries a CVSS 3.1 base score of 8.4 (HIGH), indicating confirmed real-world risk on a vast installed base of Android devices. Because the integer overflow occurs in core Android Framework code, exploitation can compromise the confidentiality, integrity, and availability of an affected device. Organizations and individuals running affected Android versions should treat CVE-2025-48595 as a priority for patching.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | 14.0; 15.0; 16.0 |
References
- https://source.android.com/docs/security/bulletin/2026/2026-06-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
An arithmetic operation in the Android Framework produces a value that exceeds the maximum of its integer type and wraps to a small or negative number, which bypasses size and bounds checks and leads to memory corruption and ultimately code execution. This wraparound is the root cause that allows a local attacker to escalate privilege without user interaction.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
The attack vector is local (AV:L), meaning the attacker needs local access to the device, for example through a malicious or compromised app. Attack complexity is low (AC:L), so exploitation is straightforward and reliable once access is obtained. The vulnerability requires no privileges (PR:N) and no user interaction (UI:N), allowing an unprivileged process to trigger it silently. The scope is unchanged (S:U), so the impact is contained within the vulnerable security authority, but within that scope the impact on confidentiality (C:H), integrity (I:H), and availability (A:H) is complete, resulting in full local compromise through privilege escalation. This combination yields a CVSS 3.1 base score of 8.4 (HIGH), while the EPSS score of 0.00401 (61.15th percentile) indicates a moderate relative likelihood of exploitation activity being observed.
Exploit Maturity
CISA has confirmed active exploitation by adding CVE-2025-48595 to its Known Exploited Vulnerabilities (KEV) catalog, which means the flaw is being abused in the wild. No public exploit code is tagged in the references, which currently include only the vendor security bulletin, so no proof-of-concept is publicly published; however, the KEV listing confirms in-the-wild exploitation and patching should be treated as urgent. The EPSS score is 0.00401 (61.15th percentile), reflecting a moderate relative likelihood of observed exploitation activity. There is no known ransomware association with this vulnerability.
Remediation
- Follow the CISA KEV required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."
- Apply the Android Security Bulletin 2026-06-01 patch level (or later) through your operating system or device update channel, and confirm that the device security patch level reflects the fix on affected Android 14, 15, and 16 devices.
- As an interim measure where OEM patches lag behind, limit installation of untrusted apps, restrict physical and logical device exposure, and use mobile threat defense (MTD) or mobile device management (MDM) to enforce patch compliance across the fleet.
- Monitor for indicators of exploitation such as abnormal app privilege escalation and crash logs that indicate memory corruption.
- For long-term resilience, keep devices on current security patch levels; for any custom system code, validate that arithmetic operations cannot overflow and enforce bounds checks against integer type limits in line with the CWE-190 guidance.
Technical Details
An integer overflow exists in multiple locations within the Android Framework, where an arithmetic operation produces a value that exceeds the maximum of its integer type and wraps to a small or negative value. This wraparound bypasses size and bounds checks, leading to memory corruption that enables code execution. The result is local escalation of privilege that requires no additional execution privileges and no user interaction. Consistent with the CVSS vector, exploitation occurs locally (AV:L) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), yielding complete impact on confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2025-48595 being actively exploited?
Yes. CISA added CVE-2025-48595 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-02, confirming in-the-wild exploitation. No public exploit code is tagged in the references, but the KEV listing means patching should be treated as urgent. There is no known ransomware association.
What products are affected by CVE-2025-48595?
The vulnerability affects the Android Framework in Google Android versions 14.0, 15.0, and 16.0.
How do I fix CVE-2025-48595?
Apply the Android Security Bulletin 2026-06-01 patch level (or later) via your OS or device update channel and confirm the device security patch level reflects the fix. Where OEM patches lag, limit untrusted app installation, restrict device exposure, and use MDM or mobile threat defense to enforce patch compliance.
How severe is CVE-2025-48595?
It is rated HIGH with a CVSS 3.1 base score of 8.4. The flaw allows local escalation of privilege with no privileges and no user interaction required, resulting in full compromise of confidentiality, integrity, and availability on the affected device. The EPSS score is 0.00401 (61.15th percentile), indicating a moderate relative likelihood of exploitation activity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.