CVE-2025-48582: MediaProvider Package Vulnerability Leading to Unauthorized Media Deletion
Summary
CVE-2025-48582: In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. Affects platform/packages/providers/MediaProvider across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The MediaProvider package is a core component of the Android operating system that facilitates the management and sharing of media files across applications. It provides a unified interface for accessing media content such as images, audio, and video. This package is crucial for maintaining media libraries and ensuring that applications can interact with media files securely and efficiently. However, vulnerabilities in this package can lead to serious security risks, including unauthorized access and manipulation of media files.
Vulnerability Detail
The vulnerability identified as CVE-2025-48582 arises from improper handling of intents within the MediaProvider package. Specifically, it allows for the deletion of media files without requiring the MANAGE_EXTERNAL_STORAGE permission, which is a significant security oversight. This flaw can lead to local escalation of privilege, enabling malicious applications to delete user media without consent. The vulnerability does not necessitate user interaction for exploitation, making it particularly dangerous. It affects multiple versions of the MediaProvider package, with a high severity rating, indicating a critical need for remediation.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the MediaProvider by limiting the permissions granted to applications that interact with media files. This can be done by reviewing and adjusting the permissions in the application settings to prevent unauthorized access until the package is updated.
Conclusion
The CVE-2025-48582 vulnerability in the MediaProvider package poses a significant risk by allowing unauthorized deletion of media files. It is crucial for developers and users to update to the patched version to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for platform/packages/providers/MediaProvider →
FAQ
CVE-2025-48582 is a vulnerability in the MediaProvider package of Android that allows unauthorized deletion of media files without the necessary permissions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized deletion of user media files, which can lead to data loss and privacy concerns.
Yes, a patch was released on March 1, 2026. Users should update to the fixed version of the MediaProvider package.
If immediate updates are not possible, consider restricting application permissions to limit access to media files as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/providers/MediaProvider.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
