{"id":"CVE-2025-48595","published":"2026-06-01T22:16:18Z","modified":"2026-07-22T08:10:00Z","title":"Android Framework Integer Overflow Vulnerability","vendor":"Android","product":"Framework","tier":"core","eol":null,"description":{"text":"In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","provenance":"source","from":"NVD"},"summary":{"text":"The Android Framework component contains an integer overflow flaw in multiple locations that can lead to code execution. An attacker with local access needs no additional execution privileges and no user interaction to exploit it, allowing escalation of privilege on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:27Z"},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.01947,"percentile":0.80138,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2026-06-02","dueDate":"2026-06-05","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://source.android.com/docs/security/bulletin/2026/2026-06-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-48595","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-06-01","exploitedFirstSeen":"2026-06-01","ransomware":false,"evidence":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-06-01","date":"2026-06-01"},{"url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e0f4f392-fea8-4612-bf6c-9e275b913edc","date":"2026-06-02"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-06-02"},{"url":"https://t.me/xakep_ru/19469","date":"2026-06-03"},{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","date":"2026-07-10"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-06-01","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local no-interaction privilege escalation exploit","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could lead to local escalation of privilege with no additional execution privileges needed","start":106,"end":196}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: integer overflow yields code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"there is a possible way to achieve code execution due to an integer overflow","start":23,"end":99}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-210013","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210013","exploited":true,"exploitedSince":"2026-06-02","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2026-06-03","earliestUrl":"https://github.com/HORKimhab/CVE-2025-48595","repos":[{"name":"HORKimhab/CVE-2025-48595","url":"https://github.com/HORKimhab/CVE-2025-48595","stars":1,"created":"2026-06-03"},{"name":"fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow-","url":"https://github.com/fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow-","stars":1,"created":"2026-06-09"},{"name":"XiaoBaiLovesStirring/CVE-2025-48595-Exploit","url":"https://github.com/XiaoBaiLovesStirring/CVE-2025-48595-Exploit","stars":0,"created":"2026-08-24"}]},"first":{"date":"2026-06-03","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2025-48595"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-06-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48595","provenance":"source"},{"date":"2026-06-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://source.android.com/docs/security/bulletin/2026/2026-06-01","provenance":"source"},{"date":"2026-06-02","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-06-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210013","provenance":"source"},{"date":"2026-06-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2025-48595","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 151 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.03,"detail":"percentile 0.8014"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.88,"detail":"base score 8.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}