CVE-2025-48590: Android Frameworks Base - Emergency Service Dialing Denial of Service Vulnerability
Summary
CVE-2025-48590: In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential services and APIs for application development. It plays a crucial role in managing app operations, including permissions and system resources. This package is integral to the functioning of Android devices, ensuring that applications can interact with the system securely and efficiently. However, it is susceptible to vulnerabilities that can compromise its functionality, such as the one described here.
Vulnerability Detail
The vulnerability identified as CVE-2025-48590 exists in the verifyAndGetBypass method of AppOpsService.java. It allows a malicious application to exploit resource exhaustion, potentially preventing users from dialing emergency services. This local denial of service can occur without requiring additional execution privileges or user interaction, making it particularly dangerous. The vulnerability affects multiple versions of the Android Frameworks Base package, leading to significant security concerns regarding emergency service accessibility.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate this vulnerability aside from applying the necessary updates. Users are advised to monitor their devices for updates regularly to ensure they are protected against this and other vulnerabilities.
Conclusion
In summary, CVE-2025-48590 is a critical vulnerability in the Android Frameworks Base package that can lead to denial of service for emergency dialing. It is essential for users to update their systems to the patched versions to mitigate this risk. Regular monitoring and updates are crucial for maintaining security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48590 is a vulnerability in the Android Frameworks Base package that allows malicious apps to prevent users from dialing emergency services due to resource exhaustion.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary consequence is a local denial of service, which can prevent users from accessing emergency services, posing a significant risk to user safety.
You can update the package through your device's software update feature or by manually downloading the patched version from the official Android source repositories.
No, user interaction is not needed for exploitation, making this vulnerability particularly concerning.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
