CVE-2025-48595

HIGH8.4

CISA KEV

Published 2026-06-01 · Updated 2026-07-22 · Source security@android.com

Summary

CVE-2025-48595 is a high-severity (CVSS 8.4) vulnerability in Android Framework. CISA added it to the Known Exploited Vulnerabilities catalog on June 2, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 5, 2026. CISA does not currently list it as used in ransomware campaigns. Android has 17 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 17 known-exploited Android vulnerabilities →

Description

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-190

CISA Known-Exploited Vulnerability

Product: Android — Framework

Name: Android Framework Integer Overflow Vulnerability

Date added: 2026-06-02 · Due: 2026-06-05

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

View on NVD

More exploited Android vulnerabilities

Most recently added to CISA KEV

CVE-2025-48633
Framework — Android Framework Information Disclosure Vulnerability
added 2025-12-02
CVE-2025-48572
Framework — Android Framework Privilege Escalation Vulnerability
added 2025-12-02
CVE-2025-48543
Runtime — Android Runtime Use-After-Free Vulnerability
added 2025-09-04
CVE-2024-43093
Framework — Android Framework Privilege Escalation Vulnerability
added 2024-11-07
CVE-2024-36971
Kernel — Android Kernel Remote Code Execution Vulnerability
added 2024-08-07
CVE-2024-32896
Pixel — Android Pixel Privilege Escalation Vulnerability
added 2024-06-13

View all →

Related CVEs

Same severity, most recent

CVE-2026-76665
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
2026-10-15 · score 7.1
CVE-2026-3712
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
2026-10-15 · score 7.3
CVE-2026-76663
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
2026-10-15 · score 7.5
CVE-2026-110908
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
2026-10-15 · score 8.8
CVE-2026-110907
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
2026-10-15 · score 7.5