CVE-2025-48595: Android Framework integer overflow enables local code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with a short remediation deadline and gives local privilege escalation to code execution, though exploitation requires local access and EPSS is low.

What it is

An integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileges without needing any additional execution privileges, and no user interaction is required. Because it is in the core framework and is listed in CISA KEV, it matters for any Android device that has not received the June 2026 bulletin fixes.

Impact

An attacker who can run code on the device gains elevated privileges, potentially reaching system-level execution. The CVSS vector shows high confidentiality, integrity and availability impact, so full compromise of the affected component is possible.

Attack surface

The vector is local (AV:L) with no privileges (PR:N) and no user interaction (UI:N), so the flaw is reached by code already running on the device rather than over the network. No authentication or victim action is needed beyond local execution.

Exploitation

CVE-2025-48595 was added to CISA KEV on 2026-06-02 with a 2026-06-05 due date, indicating known exploitation. EPSS is low at roughly 1.7 percent (76th percentile), and no ransomware use is documented.

What to do

• Apply the June 2026 Android security bulletin fixes from Google as the first action.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance and vendor mitigations, or discontinue use of affected devices.
• Restrict the ability to run untrusted local code on affected devices, for example by limiting sideloaded apps and untrusted build environments.
• Track device fleet patch status against the vendor bulletin and prioritize unpatched units.
• Monitor vendor channels for updated guidance if the bulletin is revised.

Detection

• Monitor for unexpected privilege escalation or anomalous system-level process behavior on Android devices.
• Audit which apps and processes can execute local code on managed devices and flag untrusted sources.
• Correlate device logs with the vendor bulletin patch level to find unpatched endpoints.
• Watch for post-exploitation activity consistent with local privilege escalation, such as new system-level processes or modified framework components.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.