CVE-2025-48617: High severity Google Android vulnerability

Published Jun 17, 2026

Updated

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Software

2 affected components

Google Android

Google Android=17.0

Event History

Jun 17, 2026

CVE Published

via MITRE·05:53 AM

Data Sourced

via MITRE·05:53 AM

DescriptionWeakness

Data Sourced

via NVD·01:19 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-48617?

CVE-2025-48617 has a risk score of 65, indicating a medium level of severity.

How does CVE-2025-48617 affect Google Android?

CVE-2025-48617 allows a local escalation of privilege due to a permissions bypass in the CarrierConfigLoader.java.

Who is affected by CVE-2025-48617?

Any user running a vulnerable version of Google Android could potentially be affected by CVE-2025-48617.

What is required to exploit CVE-2025-48617?

Exploitation of CVE-2025-48617 does not require any user interaction and does not need additional execution privileges.

How can I mitigate the risk of CVE-2025-48617?

To mitigate the risk of CVE-2025-48617, ensure your Google Android device is updated to the latest security patches.