CVE-2025-48585: Profiling Module Denial of Service Vulnerability
Summary
CVE-2025-48585: In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. Affects platform/packages/modules/Profiling across 2 version ranges.
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Profiling module in the Android ecosystem is designed to facilitate the profiling of applications and system performance. It provides developers with tools to monitor and analyze the behavior of their applications, allowing for optimization and debugging. However, this module has been identified to have a vulnerability that can lead to a persistent denial of service, affecting the overall stability of the system.
Vulnerability Detail
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This vulnerability allows an attacker to exploit the system without requiring additional execution privileges or user interaction. The affected functions include requestProfiling, addProfilingTriggers, removeProfilingTriggers, and others, which can be manipulated to cause the service to become unresponsive, leading to a local denial of service.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation checks in the affected functions to mitigate the risk of denial of service until the patch is applied. Ensure that all inputs are sanitized and validated before processing them in the ProfilingService.
Conclusion
The CVE-2025-48585 vulnerability in the Profiling module poses a significant risk of denial of service due to improper input validation. It is crucial to apply the necessary updates or workarounds to ensure the stability and security of applications utilizing this module.
See every vulnerability recorded for platform/packages/modules/Profiling →
FAQ
CVE-2025-48585 is a vulnerability in the Profiling module of the Android ecosystem that can lead to a persistent denial of service due to improper input validation.
Exploitation of this vulnerability can cause the Profiling service to become unresponsive, affecting the stability and performance of applications relying on profiling features.
No, user interaction is not needed for exploitation, making it easier for an attacker to leverage this vulnerability.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring access to the code or installation.
If immediate updates are not possible, implement input validation checks in the affected functions as a temporary workaround to mitigate the risk of denial of service.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Profiling.
