CVE-2025-48595

This is a bug in Android that can be abused to “trick” the device into running attacker-controlled code. If someone already has local access to the device, they may be able to gain higher permissions and take over the device. Think of it like a lock that works fine until you find a small math error in the mechanism—then someone nearby can force the door open and get access.

This matters if your business uses or manages Android devices that could be reached by a local attacker (for example, devices that can be physically accessed by untrusted people, or where local access is plausible). The vulnerability does not require logging in or user clicking, so it focuses on “local access” conditions rather than tricking users. It becomes a risk when the attacker can access the device locally and the device is on an unpatched Android build that is covered by the affected versions in the vendor bulletin.

This is RED because the vulnerability is confirmed to be exploited in the wild and it is on CISA’s KEV list. Attackers can use local access to trigger the flaw without needing a victim to click anything, so patched devices are your best protection. Follow the vendor and CISA timelines immediately—especially the CISA due date of 2026-06-05.

1. Identify affected Android versions/builds

• For each Android device you manage (employee phones, company tablets, kiosks, etc.), record the Android security patch level/build number.
• Compare that patch level against the fixed guidance in the Android security bulletin dated 2026-06-01: https://source.android.com/docs/security/bulletin/2026/2026-06-01

2. Confirm exposure

• If the device’s Android patch level is older than the bulletin’s fixed versions/levels, it is likely affected per the vendor’s bulletin.
• If your devices are not covered by the bulletin’s fixed versions, treat them as at-risk until the vendor confirms otherwise.

3. Upgrade to the fixed version/patch level

• Upgrade each affected device to the fixed Android security patch level listed in the 2026-06-01 bulletin.
• Use your normal enterprise update process (MDM/management console, OTA policy, or vendor tooling) to ensure devices actually move to the fixed patch level.

4. If you cannot patch right away (temporary containment)

• Reduce the chance of local access by untrusted parties: restrict physical access, lock devices consistently, and tighten “who can touch/hold the device.”
• Consider temporarily limiting high-risk use cases (e.g., devices used in public/visitor areas) until updates are applied.

5. Validate after remediation

• Re-check the Android security patch level after updates.
• Confirm the device reports as compliant in your management system.

6. Ongoing monitoring

• Monitor for signs of compromise consistent with device takeover (unexpected app installs, unusual settings changes, repeated crashes, or abnormal behavior).
• Keep an eye out for follow-on vendor guidance tied to the same bulletin period.

CISA due date (from KEV): 2026-06-05.

Note: No public exploit code was found, but exploitation is still confirmed in-the-wild via KEV/news reporting.

Severity is high (CVSS 8.4) with local attack conditions: the attacker needs local access to the Android device. The weakness is an integer overflow (CWE-190) that can lead to local code execution and local privilege escalation without authentication and without user interaction. The vulnerability is listed in CISA KEV (added 2026-06-02) with a remediation due date of 2026-06-05, and reporting indicates limited, targeted exploitation in the wild. No public exploit code is on record, which suggests exploitation may rely on bespoke attacker tooling rather than mass-use public PoCs. EPSS is provided as a prediction only and should not be treated as the deciding factor here because KEV/news confirm active exploitation.