CVE-2025-48584: Android Framework NotificationManagerService Denial of Service Vulnerability
Summary
CVE-2025-48584: In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. Affects platform/frameworks/base across 2 version ranges.
>= 16:0, < 16:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework is a set of APIs and libraries that allow developers to create applications for the Android operating system. It includes components such as the NotificationManagerService, which manages notifications for applications. This service is crucial for user interaction and application engagement. However, it is susceptible to vulnerabilities that can lead to resource exhaustion and denial of service.
Vulnerability Detail
In multiple functions of NotificationManagerService.java, there exists a flaw that allows for the bypassing of per-package channel limits. This can lead to resource exhaustion, resulting in a local denial of service. The vulnerability does not require additional execution privileges or user interaction for exploitation, making it particularly concerning for users and developers alike.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the number of notifications your application generates or implementing additional checks to manage notification channels effectively until the patch is applied.
Conclusion
The CVE-2025-48584 vulnerability in the Android Framework's NotificationManagerService poses a significant risk of denial of service due to resource exhaustion. It is crucial for developers to update their applications to the patched version and consider workarounds until the update can be applied.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48584 is a vulnerability in the Android Framework's NotificationManagerService that allows for denial of service due to resource exhaustion.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The vulnerability can lead to a denial of service, causing applications to become unresponsive or crash due to resource exhaustion.
No, user interaction is not needed for exploitation, making it a critical concern for application security.
If an immediate update is not possible, implement workarounds such as limiting notifications or managing notification channels more effectively.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
