CVE-2025-48595

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

Google · Android

CVSS v3.1 CNA

8.4 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.71% chance of exploitation in the next 30 days, 77th percentile

CISA KEV

added 2026-06-02

Published

2026-06-01

Updated

2026-06-03

Proof-of-concept exploits (1)

• CTIresource/Vendor-Verbiage0★ · 2026-10-15

Security advisories

• https://source.android.com/docs/security/bulletin/2026/2026-06-01

References

• CVE Record
• NVD entry

Related

• CVE-2019-1068
• CVE-2020-14472
• CVE-2021-0278
• CVE-2022-35405
• CVE-2023-22518
• CVE-2023-42793