Intel

CVE-2025-48595

In multiple locations, there is a possible way to achieve code execution due to an integer overflow (CVE-2025-48595)

criticalKEV: actively exploitedPoCEPSS 1.7%

Description

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Source: BSIBSI_CSAFBSI_CSAFBSI_CSAFBSIBSICVELISTV5OSVCISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2025-48595 is an integer overflow in Android's bundled SQLite component (platform/external/sqlite) that requires no user interaction and no prior privileges to exploit locally (CVSS:3.1 AV:L/AC:L/PR:N/UI:N, score 8.4). An EPSS score at the 75.8th percentile places it well above the median exploitability risk across all published CVEs. For NIS2-regulated organisations, the threat is most acute where Android devices serve as authentication tokens, VPN endpoints, or remote-access clients into OT/ICS environments — a local attacker with physical access or a malicious app already installed can achieve full system privileges. CISA has not flagged known ransomware campaign use, but KEV listing alone mandates treating this as actively exploited; under BSI guidance, critical vulnerabilities should be patched or compensated within 72 hours of confirmed exposure.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the Android Security Patch Level of June 2026 or later to all managed Android devices — affected branches are Android 15 and the „17-next" development branch; confirm the exact patch ID in the Google Android Security Bulletin for June 2026.
  • Query your MDM/EMM console for all enrolled devices with a Security Patch Level earlier than 2026-06-01; flag them as critical and enforce network isolation until the patch is confirmed deployed.
  • Disable privileged enterprise applications (VPN clients, MDM agents, S/MIME-enabled mail apps) on unpatched devices to prevent a local attacker from leveraging the vulnerability to reach corporate resources.
  • Exclude any device failing root-detection checks (Play Integrity API MEETS_BASIC_INTEGRITY = false) from access to critical backend systems immediately — successful exploitation yields root-equivalent privileges.
  • For BYOD devices without enforced patch management, apply a Conditional Access policy (Intune/Entra ID/Workspace ONE) to block access to corporate services until patch compliance is verified.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Confine Android devices to a dedicated Wi-Fi VLAN; permit access to internal servers only through a Zero-Trust NAC policy that enforces a minimum patch-level check as a compliance condition.
  • MDM compliance policy: Set the minimum required Security Patch Level to 2026-06-01; automatically move non-compliant devices to a quarantine VLAN and revoke access to Exchange, SharePoint, and VPN profiles.
  • Least-privilege app configuration: Deploy enterprise apps via Managed Google Play with minimal permissions; restrict INSTALL_PACKAGES, MANAGE_EXTERNAL_STORAGE, and SYSTEM_ALERT_WINDOW to explicitly approved apps only — these are common post-exploitation targets.
  • SQLite input hardening: Because the vulnerability resides in platform/external/sqlite, audit any enterprise app that feeds externally controlled data into SQLite databases (e.g. via Content Provider interfaces) for missing input validation and size-limit enforcement.
  • Mobile Threat Defense: Activate an MTD solution (e.g. Microsoft Defender for Endpoint on Android, Lookout, or Zimperium) to detect anomalous privilege-escalation attempts at the process level on enrolled devices.

Runbook · Step 3

Detection rules

  • MDM telemetry: Alert when android.security_patch_level < 2026-06-01 AND the device has active access to internal resources — KQL sketch: DeviceInfo | where OSPatchLevel < datetime(2026-06-01) and isnotempty(LastSeenNetwork).
  • Play Integrity / SafetyNet logs: Treat a transition from MEETS_BASIC_INTEGRITY = true to false on a previously compliant device as a potential post-exploit root indicator; ingest Play Integrity API results into your SIEM.
  • MTD alerts: Classify as high-priority any process showing unexpected UID escalation to UID 0 / system from an app context, or unexpected setuid calls originating from the SQLite process tree.
  • Network telemetry (Zeek/Suricata): Correlate unexpected outbound connections from Android devices to internal management segments (RFC-1918 ranges outside normal app traffic patterns) with any concurrent patch-level alert for the same device.
  • Android Logcat / auditd (if enterprise logging is active): An avc: denied entry immediately followed by avc: granted for the same process within a short window may indicate a successful SELinux bypass following privilege escalation.

Metrics

Severity
critical
Priority score
209.09
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.4
Source: nvd-v3
CVSS v3
8.4
CVSS v4
—
EPSS percentile
76.0 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
1.7 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2026-06-01 21:14 UTC
CWE
—

Affected operating systems

  • mobile

    google / android14.0

  • mobile

    google / android15.0

  • mobile

    google / android16.0

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • android

    platform/build/release15

  • android

    platform/build/release15:0

  • android

    platform/build/release16

  • android

    platform/build/release16:0

  • android

    platform/build/release16-qpr2

  • android

    platform/build/release16-qpr2:0

  • android

    platform/external/sqlite14

  • android

    platform/external/sqlite14:0

  • android

    platform/external/sqlite15

  • android

    platform/external/sqlite15:0

  • android

    platform/external/sqlite16

  • android

    platform/external/sqlite16:0

  • android

    platform/external/sqlite16-qpr2

  • android

    platform/external/sqlite16-qpr2:0

  • android

    platform/external/sqlite17-next

  • android

    platform/external/sqlite17-next:0

  • android

    platform/vendor/google_shared/build/release15

  • android

    platform/vendor/google_shared/build/release15:0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2025-48595