Paper/Archive/CVE-2025-48645

CVE-2025-48645

Google Android — In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation.

EPSS 0.2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 10.9.109 × 202.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

ProductAffectedFixed inSource

Android16-qpr2–CNA

Android16–CNA

Android15–CNA

Android14–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysource.android.com/docs/security/bulletin/2026/2026-03-01