CVE-2025-48540

In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://android.googlesource.com/platform/frameworks/native/+/570e2d6e29ee10879150f868913c285a45a936b1	Patch
https://android.googlesource.com/platform/frameworks/native/+/7fb4755c9d93bf75de13f2bc458fbbb547a79dd6	Patch
https://android.googlesource.com/platform/frameworks/native/+/ba4ea3598e6dcea4b7b2202f4cec11eb1d85c2a7	Patch
https://source.android.com/security/bulletin/2025-09-01	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:google:android:13.0:::::::*
	cpe:2.3:o:google:android:14.0:::::::*
	cpe:2.3:o:google:android:15.0:::::::*
	cpe:2.3:o:google:android:16.0:::::::*

History

No history.

Information

Published : 2025-09-04 19:15

Updated : 2025-09-05 19:04

NVD link : CVE-2025-48540

Mitre link : CVE-2025-48540

CVE.ORG link : CVE-2025-48540

JSON object : View

Products Affected

google

android

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2025-48540", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-09-04T19:15:40.333", "references": [{"url": "https://android.googlesource.com/platform/frameworks/native/+/570e2d6e29ee10879150f868913c285a45a936b1", "tags": ["Patch"], "source": "security@android.com"}, {"url": "https://android.googlesource.com/platform/frameworks/native/+/7fb4755c9d93bf75de13f2bc458fbbb547a79dd6", "tags": ["Patch"], "source": "security@android.com"}, {"url": "https://android.googlesource.com/platform/frameworks/native/+/ba4ea3598e6dcea4b7b2202f4cec11eb1d85c2a7", "tags": ["Patch"], "source": "security@android.com"}, {"url": "https://source.android.com/security/bulletin/2025-09-01", "tags": ["Vendor Advisory"], "source": "security@android.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}], "lastModified": "2025-09-05T19:04:45.957", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469"}, {"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D"}, {"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E"}, {"criteria": "cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D49E611-5D53-479D-A981-42388FDC0E8D"}], "operator": "OR"}]}], "sourceIdentifier": "security@android.com"}