CVE-2025-48595: high-severity vulnerability in Google Android
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A software component has a math error that allows an attacker to run harmful code on a system. By exploiting this flaw, someone can gain higher access rights without needing special permissions.
An integer overflow vulnerability exists across multiple code locations, enabling arbitrary code execution through numeric boundary violations. This permits local privilege escalation without requiring user interaction or elevated starting privileges; the attack vector is local and exploitation is straightforward once the overflow condition is triggered.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.