CVE-2025-48633
Android Framework Information Disclosure Vulnerability
CVSS
5.5
Média
EPSS
0.3%
p18
KEV
SIM
2 de dez. de 2025
Exploit Today
55
0-100
Publicado: 8 de dez. de 2025 · Última mod.: 7 de out. de 2026
Produto
Android / Framework
Vulnerabilidade
Android Framework Information Disclosure Vulnerability
Adicionado ao KEV
2 de dez. de 2025
Corrigir até
23 de dez. de 2025
Uso conhecido em ransomware
Não
Descrição resumida
Android Framework contains an unspecified vulnerability that allows for information disclosure.
Ação necessária
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notas
https://source.android.com/docs/security/bulletin/2025-12-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48633
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.