CVE-2025-48575: CertInstaller Package Local Privilege Escalation Vulnerability
Summary
CVE-2025-48575: In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. Affects platform/packages/apps/CertInstaller across 5 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CertInstaller package is an Android application responsible for managing and installing security certificates on devices. It plays a crucial role in ensuring secure communications by allowing users to install trusted certificates. However, due to a permissions bypass vulnerability, it is susceptible to exploitation, potentially allowing unauthorized users to install certificates without proper permissions.
Vulnerability Detail
In multiple functions of CertInstaller.java, there exists a permissions bypass that enables the installation of certificates without the necessary authorization. This vulnerability can lead to local escalation of privilege, allowing an attacker to gain elevated privileges on the device without requiring additional execution privileges or user interaction. The flaw is rooted in the way the application handles permissions, making it a significant security risk.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the CertInstaller application or monitor its usage closely until the patch is applied. Additionally, consider using alternative methods for certificate management that do not rely on the vulnerable package.
Conclusion
The CVE-2025-48575 vulnerability in the CertInstaller package poses a significant risk of local privilege escalation due to a permissions bypass. It is crucial for users to update to the patched version to mitigate this risk. Regular monitoring and using tools like Vulert can help in identifying vulnerabilities in open-source software.
See every vulnerability recorded for platform/packages/apps/CertInstaller →
FAQ
CVE-2025-48575 is a vulnerability in the CertInstaller package that allows local privilege escalation due to a permissions bypass.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized installation of security certificates, which can compromise the integrity and confidentiality of communications on the device.
No, user interaction is not needed for exploitation, making it particularly dangerous.
If immediate updates are not possible, consider implementing strict access controls and monitoring the usage of the CertInstaller application.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/CertInstaller.
