CVE-2025-48595

high · 8.4Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added 2026-06-02Remediation due 2026-06-05

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

8.4

CVSS

1.7%

EPSS (exploit prob.)

76th

EPSS percentile

2026-06-01

Published

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-190

Affected products

Vendor	Product	Affected versions
google	android	14.0
google	android	15.0
google	android	16.0
google	android	16.0
google	android	16.0
google	android	16.0

Check a specific version with /api/v1/cve/match.

References

https://source.android.com/docs/security/bulletin/2026/2026-06-01
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-48595