← Vulnerability feed

Vulnerability record · CVE-2025-48633 · published 8 December 2025

CVE-2025-48633: Android DevicePolicyManagerService logic error allows Device Owner addition

Google · Android

A logic error in hasAccountsOnAnyUser within DevicePolicyManagerService.java lets a Device Owner be added after provisioning. This breaks the intended provisioning boundary on Android and enables local privilege escalation, with no user interaction required.

5.5 CVSS 3.1 Medium CISA KEV since 2 Dec 2025 EPSS 0.26% · top 83.8%
5.5CVSS 3.1 base score
0.26%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCISA KEV listing indicates known exploitation, but the local-only vector, low EPSS, and medium CVSS score keep it below critical.

What it is

A logic error in hasAccountsOnAnyUser within DevicePolicyManagerService.java lets a Device Owner be added after provisioning. This breaks the intended provisioning boundary on Android and enables local privilege escalation, with no user interaction required.

Impact

A local attacker can gain Device Owner level control over the device, which typically grants broad device management and policy capabilities beyond their intended privileges. The CVSS vector rates confidentiality impact as high, with no integrity or availability impact stated.

Attack surface

Reached locally on the device through the Android framework; the CVSS vector is AV:L/PR:L/UI:N, so a low-privileged local actor is needed and no user interaction is required. No network or remote vector is described.

Exploitation

CVE-2025-48633 is listed in CISA KEV with a due date of 2025-12-23, indicating known exploitation, while EPSS is low at 0.00262 (18th percentile). No ransomware campaign use is documented.

What to do

  • Apply the Android security bulletin 2025-12-01 update or the referenced AOSP patch d00bcda9f42dcf272d329e9bf9298f32af732f93 as soon as possible.
  • Follow CISA BOD 22-01 required actions and vendor mitigation guidance for affected Android devices.
  • Restrict local access and untrusted app installation on managed devices to reduce the low-privileged local attack path.
  • If patching is not possible, consider discontinuing use of affected devices per CISA guidance.

Detection

  • Monitor for unexpected Device Owner or device policy changes after initial provisioning on Android devices.
  • Audit DevicePolicyManagerService and device admin events for additions of Device Owner outside normal enrollment workflows.
  • Correlate local app activity with device policy state changes to identify abuse of the hasAccountsOnAnyUser logic path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2025-48633 to the Known Exploited Vulnerabilities catalog on 2 December 2025 as "Android Framework Information Disclosure Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 23 December 2025.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93 PatchProduct
https://source.android.com/security/bulletin/2025-12-01 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48633 US Government Resource

Track CVE-2025-48633 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-58704Android Cellular Modem improper authorization allows adjacent privilege escalationAndroid's Cellular Modem component contains a logic error that bypasses permission checks, allowing an attacker within radio/adjacent range to escala…KEVEPSS 0.59%analysed8.8CVE-2025-48543Android use-after-free allows Chrome sandbox escape to system_serverA use-after-free in multiple Android locations lets an attacker escape the Chrome sandbox and reach the Android system_server process. Because the fl…KEVEPSS 0.54%analysed8.4CVE-2025-48595Android Framework integer overflow enables local code executionAn integer overflow in multiple locations of the Android Framework can be turned into code execution. It allows a local attacker to escalate privileg…KEVEPSS 1.7%analysed7.8CVE-2025-48572Android Framework permissions bypass enables background activity launchMultiple locations in the Android Framework allow activities to be launched from the background because of a permissions bypass, a missing authentica…KEVEPSS 0.26%analysed7.8CVE-2024-32896Android Pixel logic error allows local privilege escalationCVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. I…KEVEPSS 3.0%analysed7.8CVE-2024-29748Android Pixel logic error allows local privilege escalationCVE-2024-29748 is a logic error in Android code that permits bypassing a security check, leading to local escalation of privilege. It affects Google …KEVEPSS 0.67%analysed7.8CVE-2023-35674Android WindowState logic error allows background activity launch and privilege escalationA logic error in onCreate of WindowState.java in the Android Framework lets a background activity be launched, enabling local escalation of privilege…KEVEPSS 2.6%analysed7.8CVE-2023-20963Android WorkSource parcel mismatch local privilege escalationCVE-2023-20963 is a parcel mismatch in Android's WorkSource component that allows a local attacker to escalate privileges without additional executio…KEVEPSS 1.5%analysed

Source: NIST National Vulnerability Database (record CVE-2025-48633), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.