CVE-2025-48530: Remote Code Execution Vulnerability in Android's Crabbyavif Package
Summary
CVE-2025-48530: In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. Affects platform/external/rust/crabbyavif across 2 version ranges.
>= 16:0, < 16:2025-08-01
>= 16-next:0, < 16-next:2025-08-01
Fixed in 16-next:2025-08-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Crabbyavif package is part of the Android ecosystem, specifically designed for handling AVIF image formats. It provides functionalities for encoding and decoding AVIF images, which are known for their efficient compression and high-quality output. However, due to a critical vulnerability, the package is susceptible to out-of-bounds (OOB) accesses that could lead to severe security risks, including remote code execution.
Vulnerability Detail
The vulnerability arises from multiple locations within the Crabbyavif package where incorrect bounds checks are implemented. This oversight can lead to out-of-bounds accesses, allowing attackers to exploit the vulnerability in conjunction with other bugs. The exploitation does not require any additional execution privileges or user interaction, making it particularly dangerous. The severity of this vulnerability is classified as critical, as it poses significant risks to the integrity and security of systems utilizing this package.
How To Fix
Minimum fixed version
16-next:2025-08-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
In summary, CVE-2025-48530 is a critical vulnerability in the Crabbyavif package that poses significant risks due to its potential for remote code execution. It is essential to update the package to the patched version to ensure the security of your applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for platform/external/rust/crabbyavif →
FAQ
CVE-2025-48530 is a critical vulnerability in the Crabbyavif package of the Android ecosystem that allows for remote code execution due to incorrect bounds checks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on affected systems, potentially compromising security.
No, user interaction is not needed for exploitation, making it particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risks associated with this vulnerability.
