CVE-2025-48550: Android Frameworks Base Package Denial of Service Vulnerability
Summary
CVE-2025-48550: In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path traversal error. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-09-01
>= 14:0, < 14:2025-09-01
>= 15:0, < 15:2025-09-01
>= 16:0, < 16:2025-09-01
>= 16-next:0, < 16-next:2025-09-01
Fixed in 16-next:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It handles various system-level functionalities, including permission management and inter-process communication. This package is critical for maintaining the stability and security of Android applications. However, it is susceptible to vulnerabilities that can lead to severe security issues, such as denial of service attacks.
Vulnerability Detail
In the testGrantSlicePermission method of SliceManagerTest.java, a path traversal error has been identified, which can lead to a permanent denial of service. This vulnerability allows an attacker to exploit the system without requiring additional execution privileges, potentially causing significant disruption to services. The issue arises from improper handling of file paths, which can be manipulated to access restricted areas of the system, leading to service interruptions.
How To Fix
Minimum fixed version
16-next:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional input validation and sanitization in the affected areas of your application to prevent unauthorized access to file paths. However, the best course of action is to apply the patch as soon as possible.
Conclusion
CVE-2025-48550 represents a critical vulnerability in the Android Frameworks Base package that can lead to denial of service. It is essential to apply the available patch to protect your applications from potential exploitation. Regular monitoring and updates are crucial for maintaining security in open-source software.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48550 is a vulnerability in the Android Frameworks Base package that allows for a denial of service due to a path traversal error.
Exploitation of this vulnerability can lead to service disruptions, causing your application to become unresponsive or crash.
No, user interaction is not needed for exploitation, making it a significant risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot apply the patch right away, implement input validation and sanitization as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
