CVE-2025-48554: Android Frameworks Base Denial of Service Vulnerability
Summary
CVE-2025-48554: In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-09-01
>= 14:0, < 14:2025-09-01
>= 15:0, < 15:2025-09-01
>= 16:0, < 16:2025-09-01
>= 16-next:0, < 16-next:2025-09-01
Fixed in 16-next:2025-09-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It facilitates device management, user interface interactions, and system-level operations. This package is critical for the stability and functionality of Android devices, making it a prime target for vulnerabilities that could disrupt its operations.
Vulnerability Detail
In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. This vulnerability can lead to local denial of service, requiring user interaction for exploitation. The flaw arises from improper handling of package changes, which could result in the device becoming unresponsive to certain administrative commands, severely impacting device usability.
How To Fix
Minimum fixed version
16-next:2025-09-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-48554 represents a significant denial of service vulnerability within the Android Frameworks Base package. Users are encouraged to monitor for updates and apply patches promptly to ensure device security and functionality.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48554 is a vulnerability in the Android Frameworks Base package that can lead to a denial of service due to a logic error in the handlePackagesChanged function.
Exploitation of this vulnerability could result in your device becoming unresponsive to certain administrative commands, leading to a denial of service.
Yes, user interaction is needed for the exploitation of this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without any signup.
The patch for this vulnerability is expected to be available by September 1, 2025.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
