CVE-2025-48552: Android Frameworks Base Local Privilege Escalation Vulnerability
Summary
CVE-2025-48552: In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to a logic error in the code. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-09-01
>= 14:0, < 14:2025-09-01
>= 15:0, < 15:2025-09-01
>= 16:0, < 16:2025-09-01
>= 16-next:0, < 16-next:2025-09-01
Fixed in 16-next:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It manages device policies, security settings, and system configurations. This package is critical for maintaining the integrity and security of Android devices. The vulnerability in question arises from a logic error in the 'saveGlobalProxyLocked' function within the DevicePolicyManagerService, which can lead to unintended privilege escalation.
Vulnerability Detail
In the 'saveGlobalProxyLocked' method of DevicePolicyManagerService.java, a logic error can cause a desynchronization with persistence. This vulnerability allows a local attacker to escalate privileges without requiring additional execution rights or user interaction. The flaw is significant as it could potentially allow unauthorized access to sensitive system functionalities, undermining the security model of the Android operating system.
How To Fix
Minimum fixed version
16-next:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-48552 represents a serious local privilege escalation vulnerability in the Android Frameworks Base package. Users are advised to update their systems promptly to the patched version to protect against potential exploitation. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48552 is a vulnerability in the Android Frameworks Base package that allows local privilege escalation due to a logic error in the 'saveGlobalProxyLocked' function.
This vulnerability can potentially allow unauthorized users to gain elevated privileges on your device, compromising its security.
No, user interaction is not needed for exploitation, making it a significant security risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds, it is crucial to prioritize updating your device to the patched version as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
