CVE-2025-48595

8.4

HIGH CVSS 3.1

Android Framework Integer Overflow Vulnerability - [Actively Exploited]

Overview

Description

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Details

INFO

Published Date :

June 1, 2026, 10:16 p.m.

Last Modified :

June 2, 2026, 8:19 p.m.

Remotely Exploit :

No

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Jun 05, 2026

Alert Date: Jun 02, 2026 | 22 days ago

Description :

Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://source.android.com/docs/security/bulletin/2026/2026-06-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48595

Impact

Affected Products

The following products are affected by CVE-2025-48595 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Google	android

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				134c704f-9b21-4f2e-91b3-4a467353bcc0

Solution

Address integer overflow vulnerabilities to prevent local privilege escalation.

Validate all integer inputs.
Check for potential overflows before operations.
Apply necessary code patches.
Update affected software.

Public PoC/Exploit Available at Github

CVE-2025-48595 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-48595.

URL	Resource
https://source.android.com/docs/security/bulletin/2026/2026-06-01	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-48595 is associated with the following CWEs:

CWE-190: Integer Overflow or Wraparound

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-48595 weaknesses.

CAPEC-92: Forced Integer Overflow Forced Integer Overflow

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow-

VE-2025-48595 es una vulnerabilidad de **desbordamiento de entero (integer overflow)** en múltiples ubicaciones del Framework de Android.

Shell

Updated: 2 weeks ago

0 stars 0 fork 0 watcher

Born at : June 9, 2026, 8:17 p.m. This repo has been linked 1 different CVEs too.

HORKimhab/CVE-2025-48595

CVE-2025-48595 - Draft

Updated: 3 weeks ago

0 stars 1 fork 1 watcher

Born at : June 3, 2026, 12:30 a.m. This repo has been linked 1 different CVEs too.

DeliciousToe/CVE-notification-n8n

None

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : June 2, 2026, 8:02 p.m. This repo has been linked 1 different CVEs too.

barmi/cve-patch-auditor

Audit CVE impact, patch status, remediation progress, and verification results across systems.

Makefile Go

Updated: 2 weeks, 4 days ago

3 stars 2 fork 2 watcher

Born at : May 16, 2026, 2:19 a.m. This repo has been linked 25 different CVEs too.

myseq/tracker

Security Tracker

Python

Updated: 2 weeks, 2 days ago

0 stars 0 fork 0 watcher

Born at : April 3, 2026, 11 a.m. This repo has been linked 5 different CVEs too.

DevGreick/devgreick

None

Python

Updated: 2 weeks, 2 days ago

1 stars 1 fork 1 watcher

Born at : Oct. 29, 2024, 8:10 p.m. This repo has been linked 10 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-48595 vulnerability anywhere in the article.

The Cyber Express

Cisco Warns of Active Exploitation of Catalyst SD-WAN Flaw With No Patch Available

Cisco has issued an urgent warning that a high-severity vulnerability in its Catalyst SD-WAN Manager platform is being actively exploited in the wild—and no patch exists yet. CVE-2026-20245 allows aut ...

Published Date: Jun 08, 2026 (2 weeks, 2 days ago)

The Cyber Express

The Cyber Express Weekly Roundup: Cloud Extortion, Long-Term Espionage, Android Zero-Days, and Public Sector Security Reviews

The cybersecurity landscape in this weekly roundup continues to show a clear shift toward identity-driven attacks, long-term persistence operations, and exploitation of trusted cloud environments. Thr ...

Published Date: Jun 05, 2026 (2 weeks, 4 days ago)

TheCyberThrone

CISA adds Three Vulnerabilities to KEV Catalog

OverviewCISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation — CVE-2022-0492, a Linux Kernel Improper Authentication v ...

Published Date: Jun 04, 2026 (2 weeks, 5 days ago)

The Cyber Express

AI-Powered Bots Are Blurring the Line Between Users and Cyber Threats

For years, security teams have relied on behavioral clues to identify malicious activity. However, the rise of AI-powered bots is making that task far more challenging. Unlike traditional automated to ...

Published Date: Jun 04, 2026 (2 weeks, 5 days ago)

CybersecurityNews

CISA Warns of Android Framework Integer Overflow Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly identified Android Framework vulnerability, tracked as CVE-2025-48595, to its Known Exploited Vulnerabilities (KEV) c ...

Published Date: Jun 04, 2026 (2 weeks, 5 days ago)

The Hacker News

Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited

Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that h ...

Published Date: Jun 02, 2026 (3 weeks ago)

TheCyberThrone

Google Android June 2026 Security Bulletin

OverviewGoogle has released the June 2026 Android security patches to address 124 vulnerabilities, including one zero-day flaw exploited in targeted attacks. The bulletin spans Framework, System, Kern ...

Published Date: Jun 02, 2026 (3 weeks ago)

security.nl

Google waarschuwt voor actief misbruikt beveiligingslek in Androidtelefoons

Google waarschuwt voor een actief misbruikte kwetsbaarheid in Androidtelefoons en heeft updates uitgebracht om het probleem te verhelpen. Daarnaast zijn ook patches verschenen voor twee kritieke bevei ...

Published Date: Jun 02, 2026 (3 weeks ago)

CybersecurityNews

Android 0-Day Vulnerability Exploited in Attacks to Gain Complete Device Control

A critical Android zero-day vulnerability is being actively exploited in targeted attacks, allowing threat actors to gain near-complete control over affected devices without any user interaction. The ...

Published Date: Jun 02, 2026 (3 weeks, 1 day ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2025-48595 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

Initial Analysis by [email protected]

Jun. 02, 2026

Action	Type	New Value
Added	CPE Configuration	OR cpe:2.3:o:google:android:14.0::::::: cpe:2.3:o:google:android:15.0::::::: cpe:2.3:o:google:android:16.0:-::::::* cpe:2.3:o:google:android:16.0:qpr2_beta_1::::::* cpe:2.3:o:google:android:16.0:qpr2_beta_2::::::* cpe:2.3:o:google:android:16.0:qpr2_beta_3::::::*
Added	Reference Type	Android (associated with Google Inc. or Open Handset Alliance): https://source.android.com/docs/security/bulletin/2026/2026-06-01 Types: Vendor Advisory
Added	Reference Type	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595 Types: US Government Resource

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Jun. 02, 2026

Action	Type	Old Value	New Value
Added	Reference		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595

CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

Jun. 02, 2026

Action	Type	New Value
Added	Date Added	2026-06-02
Added	Due Date	2026-06-02
Added	Required Action	2026-06-02
Added	Vulnerability Name	2026-06-02

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

Jun. 01, 2026

Action	Type	Old Value	New Value
Added	CVSS V3.1		AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Added	CWE		CWE-190

New CVE Received by [email protected]

Jun. 01, 2026

Action	Type	Old Value	New Value
Added	Description		In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Added	Reference		https://source.android.com/docs/security/bulletin/2026/2026-06-01

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.

CVE-2025-48595

Android Framework Integer Overflow Vulnerability - [Actively Exploited]

Description

INFO

June 1, 2026, 10:16 p.m.

June 2, 2026, 8:19 p.m.

No

[email protected]

CISA KEV (Known Exploited Vulnerabilities)