CVE-2025-48544: SQL Injection
In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/platform/packages/providers/MediaProviderto a version that resolves this vulnerability.Fixed in 16-qpr2-next:2026-03-01 - Upgrade
Upgrade
android/platform/packages/providers/MediaProviderto a version that resolves this vulnerability.Fixed in 15:2026-03-01 - Upgrade
Upgrade
android/platform/packages/providers/MediaProviderto a version that resolves this vulnerability.Fixed in 16:2026-03-01 - Upgrade
Upgrade
android/platform/packages/providers/MediaProviderto a version that resolves this vulnerability.Fixed in 14:2026-03-01
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48544?
CVE-2025-48544 has a critical severity rating due to its potential for local escalation of privilege via SQL injection.
How do I fix CVE-2025-48544?
To fix CVE-2025-48544, update your Android device to the latest security patch provided by Google.
What versions of Android are affected by CVE-2025-48544?
CVE-2025-48544 affects multiple versions of Android, specifically those with vulnerable implementations of the MediaProvider.
Is user interaction required to exploit CVE-2025-48544?
No, user interaction is not required to exploit CVE-2025-48544 as it can occur automatically.
What type of vulnerability is CVE-2025-48544?
CVE-2025-48544 is a SQL injection vulnerability that can lead to unauthorized file access and privilege escalation.