CVE-2025-48633
Published 2025-12-08 · Updated 2026-10-07 · Source security@android.com
Summary
CVE-2025-48633 is a medium-severity (CVSS 5.5) vulnerability in Android Framework. CISA added it to the Known Exploited Vulnerabilities catalog on December 2, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 23, 2025. CISA does not currently list it as used in ransomware campaigns. Android has 17 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 17 known-exploited Android vulnerabilities →Description
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: Android — Framework
Name: Android Framework Information Disclosure Vulnerability
Date added: 2025-12-02 · Due: 2025-12-23
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.