CVE-2025-48542: Android Frameworks Base Package Denial of Service Vulnerability
Summary
CVE-2025-48542: In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-09-01
>= 14:0, < 14:2025-09-01
>= 15:0, < 15:2025-09-01
>= 16:0, < 16:2025-09-01
>= 16-next:0, < 16-next:2025-09-01
Fixed in 16-next:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It facilitates interactions between the Android OS and applications, managing resources such as accounts, permissions, and user data. This package is crucial for maintaining the overall functionality and security of Android devices. However, it is susceptible to vulnerabilities that can lead to severe issues, including denial of service.
Vulnerability Detail
In multiple functions of AccountManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This vulnerability can lead to local denial of service with no additional execution privileges needed. User interaction is not required for exploitation, making it a significant risk for users and applications relying on the affected services.
How To Fix
Minimum fixed version
16-next:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the number of account operations or implementing rate limiting to reduce the impact of potential resource exhaustion. This can help mitigate the effects of the vulnerability until a patch is applied.
Conclusion
The CVE-2025-48542 vulnerability poses a significant risk to applications using the Android Frameworks Base package, potentially leading to a denial of service. It is crucial for developers and users to apply the necessary updates and monitor their applications for vulnerabilities to maintain security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48542 is a vulnerability in the Android Frameworks Base package that allows for a potential denial of service due to resource exhaustion.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without requiring signup.
The vulnerability can lead to a permanent denial of service, affecting the functionality of applications that rely on the Android Frameworks Base package.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
Update the Android Frameworks Base package to the latest patched version and consider implementing rate limiting as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
