CVE Watch7 oct 2026

CVE-2025-48572

Android Framework Privilege Escalation Vulnerability

CVSS

7.8

Alto

EPSS

0.3%

p16

KEV

SÍ

2 dic 2025

Exploit Today

0-100

Publicado: 8 dic 2025 · Última mod.: 7 oct 2026 · CWE-306

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-09-182026-10-15

Ficha del catálogo KEV

Producto

Android / Framework

Vulnerabilidad

Android Framework Privilege Escalation Vulnerability

Añadido a KEV

2 dic 2025

Remediar antes de

23 dic 2025

Uso conocido en ransomware

Descripción resumida

Android Framework contains an unspecified vulnerability that allows for privilege escalation.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://source.android.com/docs/security/bulletin/2025-12-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48572

Descripción técnica

In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1117195.9 MED

—

———Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.5h CVE-2026-1117067.5 ALT

—

———99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.5h CVE-2026-1117049.8 CRÍ

—

———LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.5h CVE-2026-1117017.0 ALT

—

———OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.5h CVE-2026-1116994.8 MED

—

———Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.5h CVE-2026-1116945.3 MED

—

———qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure.5h