CVE-2025-48615: High severity Google Android vulnerability
Published Dec 1, 2025
·Updated
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
5 affected components
Google Android
Google Android=13.0
Google Android=14.0
Google Android=15.0
Google Android=16.0
Remediation
Event History
Dec 1, 2025
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Dec 8, 2025
CVE Published
via MITRE·04:57 PM
Data Sourced
via MITRE·04:57 PM
DescriptionWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-48615?
CVE-2025-48615 has a high severity due to its potential for local escalation of privilege.
2
How do I fix CVE-2025-48615?
To mitigate CVE-2025-48615, update your Android device to the latest version available from Google.
3
What are the affected versions for CVE-2025-48615?
CVE-2025-48615 affects Android versions 13.0, 14.0, 15.0, and 16.0.
4
Is user interaction required to exploit CVE-2025-48615?
No, user interaction is not needed to exploit CVE-2025-48615.
5
What impact does CVE-2025-48615 have on Android devices?
CVE-2025-48615 can lead to a desync in persistence due to resource exhaustion, resulting in potential privilege escalation.