CVE-2025-48530: High severity Google Android vulnerability
In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/external/rust/crabbyavifto a version that resolves this vulnerability.Fixed in 16-next:2025-08-01 - Upgrade
Upgrade
android/platform/external/rust/crabbyavifto a version that resolves this vulnerability.Fixed in 16:2025-08-01
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates network access is required, while no privileges or user interaction are required. Exploitation has high attack complexity.
Can this vulnerability by itself result in remote code execution?
The available information states that remote code execution could result when this issue is combined with other bugs. No additional execution privileges are needed for that combined attack path.