CVE Watch22 jul 2026

CVE-2025-48595

Android Framework Integer Overflow Vulnerability

CVSS

8.4

Alto

EPSS

1.7%

p76

KEV

SÍ

2 jun 2026

Exploit Today

0-100

Publicado: 1 jun 2026 · Última mod.: 22 jul 2026 · CWE-190

EPSS · 30d

1.7%EPSS · 30 días1.7%

2026-08-022026-08-31

Ficha del catálogo KEV

Producto

Android / Framework

Vulnerabilidad

Android Framework Integer Overflow Vulnerability

Añadido a KEV

2 jun 2026

Remediar antes de

5 jun 2026

Uso conocido en ransomware

Descripción resumida

Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://source.android.com/docs/security/bulletin/2026/2026-06-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48595

Descripción técnica

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-547559.6 CRÍ

31.6%

——9Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32 accumulators. Crafted values such as two 0x80000000 entries wrap the validation sum to zero and pass CheckValid100Params. Royalty payout paths in core/kapp/accounts/accounts.go, core/kapp/market/market.go, and core/kapp/ito/ito.go then credit each oversized split amount and silently discard a negative remainder, allowing ordinary asset transfers, marketplace purchases, or ITO purchases to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.3d CVE-2026-19313—

38.9%

——12An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.3d CVE-2026-383507.5 ALT

24.9%

——7An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.3d CVE-2026-383497.5 ALT

24.9%

——7An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.3d CVE-2026-383487.5 ALT

24.9%

——7An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.3d CVE-2026-383467.5 ALT

24.9%

——7An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.3d