CVE-2025-48592: Open Source Vulnerability in platform/frameworks/av Leading to Heap Buffer Overflow
Summary
CVE-2025-48592: In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. Affects platform/frameworks/av across 3 version ranges.
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-next:0, < 16-next:2025-12-01
Fixed in 16-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/frameworks/av package is a core component of the Android operating system, responsible for handling audio and video processing. It provides essential APIs for media playback and recording, enabling developers to create rich multimedia applications. However, this package has been found to contain a critical vulnerability that could lead to severe security risks.
Vulnerability Detail
In the C2SoftDav1dDec.cpp file, specifically in the initDecoder function, there exists a potential out-of-bounds read due to a heap buffer overflow. This vulnerability can be exploited remotely, allowing attackers to disclose sensitive information without requiring any additional execution privileges or user interaction. The flaw arises from improper handling of memory allocation, which can lead to unintended access to memory locations.
How To Fix
Minimum fixed version
16-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patches as soon as they are available to mitigate the risk.
Conclusion
The CVE-2025-48592 vulnerability in the platform/frameworks/av package poses a significant risk due to its potential for remote exploitation. It is essential for developers and users to apply the available patches promptly to safeguard their applications and user data.
See every vulnerability recorded for platform/frameworks/av →
FAQ
CVE-2025-48592 is a vulnerability identified in the platform/frameworks/av package that allows for a heap buffer overflow, potentially leading to remote information disclosure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive information, which could be exploited by attackers to compromise user data and privacy.
No, user interaction is not needed for exploitation, making this vulnerability particularly dangerous.
While there are no specific workarounds, it is crucial to prioritize applying the patches as soon as possible to protect against potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/av.
