CVE-2025-48595

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-48595 8.4

Android · Framework · Added 2026-06-02 · Published 2026-06-01

3-Day Required KEV Active Exploitation

Details

VulnerabilityAndroid Framework Integer Overflow Vulnerability

VendorAndroid

ProductFramework

Date added2026-06-02

Due date2026-06-05

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-190

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.

NVD: In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-12 13:42 UTC

Wall time120.0s

Searches6

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-48595
https://source.android.com/docs/security/bulletin/2026/2026-06-01
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://www.cisa.gov/news-events/alerts/2026/06/02/cisa-adds-two-known-exploited-vulnerabilities-catalog
https://github.com/HORKimhab/CVE-2025-48595
https://github.com/fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow-
https://dbugs.ptsecurity.com/vulnerability/PT-2026-45567
https://threat-modeling.com/android-framework-zero-day-cve-2025-48595/
https://www.helpnetsecurity.com/2026/06/02/android-vulnerability-exploited-cve-2025-48595/
https://www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/
https://www.sentinelone.com/vulnerability-database/cve-2025-48595/
https://feedly.com/cve/CVE-2025-48595
https://www.threatclaw.ai/cve/CVE-2025-48595
https://app.opencve.io/cve/CVE-2025-48595
https://securityboulevard.com/2026/06/google-fixes-actively-exploited-android-zero-day-cve-2025-48595/

QC notes

warn component_extraction: Component 'Android Framework unspecified service component (Framework API and system services layer, internal Android ID A-430889718)' matches or contains product name 'Framework' — no specific component identified

Hunting hypothesis agent

Monitor for Android processes triggering integer overflow conditions in Framework service components — local escalation of privilege via unpatched Android runtime libraries.

Research details

ComponentAndroid Framework unspecified service component (Framework API and system services layer, internal Android ID A-430889718)

PreconditionsCVE-2025-48595 is an integer overflow vulnerability (CWE-190) affecting multiple locations within the Android Framework — the core system layer that runs on every Android device, providing APIs and system services that apps interact with directly. An integer overflow in Framework service components can be triggered to achieve arbitrary code execution in a privileged context, leading to local escalation of privilege on the device. The vulnerability affects Android versions 14, 15, 16, and 16-QPR2 (including beta releases). No user interaction is required for exploitation (UI:N) and no additional execution privileges are needed (PR:N), meaning any malicious app or process running on the device can trigger the overflow automatically without prompting the user. The attack vector is local (AV:L), indicating exploitation occurs through a malicious application installed on the device. Attack workflow: (1) The attacker delivers a malicious app via social engineering, drive-by download, compromised app store, or pre-installed malware. (2) The app triggers an integer overflow in one of the vulnerable Framework service components by passing crafted input parameters. (3) The overflow leads to memory corruption that the attacker leverages to achieve code execution. (4) The code execution occurs within a privileged Framework system service context, granting the attacker elevated permissions on the device — potentially bypassing Android's sandbox and achieving system-level or root-level access. Google confirmed limited, targeted exploitation in the wild, with phrasing consistent with commercial spyware vendors or nation-state actors (Heliconia, Predator, Hermit-like campaigns). The fix was released in the June 2026 Android Security Bulletin (patch levels 2026-06-01 and 2026-06-05). The internal Android bug ID is A-430889718. The vulnerability was reserved on 2025-05-22, published on 2026-06-01, and added to CISA KEV on 2026-06-02 with a remediation deadline of 2026-06-05. No verified public proof-of-concept exploit code has been identified; GitHub repositories referencing this CVE appear to be template/placeholder repositories without functional exploit code. agent

DeliveryThe exploit is delivered to the target Android device primarily through a malicious application that the user is tricked into installing (via social engineering, phishing, drive-by downloads, or sideloading). Once installed, the app triggers the integer overflow locally on the device without requiring any user interaction — the privilege escalation happens automatically in the background. The vulnerability could also potentially be exploited through web-to-app chaining (via Android WebView or browser exploits that achieve initial code execution, then chain this integer overflow for privilege escalation). In targeted attack scenarios, commercial spyware vendors or nation-state actors may deliver the exploit through watering hole attacks, spear-phishing with malicious APK attachments, or compromised third-party app stores.

Public PoCno

PoC URLs https://github.com/HORKimhab/CVE-2025-48595
https://github.com/fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow- Third-party repos; verify before use.

Advisoryhttps://source.android.com/docs/security/bulletin/2026/2026-06-01

Exploit notesLow complexity (CVSS AC:L). Integer overflow triggered locally with no user interaction and no additional privileges required. The exact vulnerable code paths within the Framework have not been publicly detailed. Exploitation difficulty is reduced by the fact that no special privileges or user interaction are needed, making this a straightforward privilege escalation vector once an initial app install foothold is achieved. Google Play Protect and SELinux enforcement may provide partial mitigation barriers.

SummaryAndroid Framework integer overflow in multiple service components enables local privilege escalation without user interaction or additional privileges — actively exploited in limited targeted attacks, no verified public PoC identified, fixed in June 2026 Android Security Bulletin.

Tia coverage

First reported2026-06-02

First exploit report2026-06-02

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

android-zero-day-cve-2025-48595-actively-exploited-google-s-june

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.