CVE-2025-48594: Android Framework Base Package Local Privilege Escalation Vulnerability
Summary
CVE-2025-48594: In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. Affects platform/frameworks/base across 4 version ranges.
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-next:0, < 16-next:2025-12-01
Fixed in 16-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Framework Base package is a core component of the Android operating system, responsible for providing essential services and APIs that applications rely on. It facilitates communication between the operating system and applications, ensuring that they can function effectively. This package is critical for maintaining the overall security and stability of the Android ecosystem. However, it is susceptible to vulnerabilities that can lead to security breaches, such as the one described in this report.
Vulnerability Detail
In the DisassociationProcessor.java file, the onUidImportance function contains a flaw due to improper input validation. This vulnerability allows a malicious actor to retain companion application privileges even after disassociation, potentially leading to local escalation of privileges without requiring additional execution privileges. Exploitation of this vulnerability necessitates user interaction, making it a significant concern for device security.
How To Fix
Minimum fixed version
16-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit the use of companion applications until the patch is applied. This can be done by disabling the companion application features in the device settings to mitigate the risk of privilege escalation.
Conclusion
The CVE-2025-48594 vulnerability in the Android Framework Base package poses a significant risk of local privilege escalation due to improper input validation. Users are encouraged to update their systems to the patched version to ensure their devices remain secure. In the meantime, disabling companion applications can help mitigate potential risks.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48594 is a vulnerability in the Android Framework Base package that allows local privilege escalation due to improper input validation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any signup.
The main risk is that a malicious user could retain elevated privileges, potentially leading to unauthorized access to sensitive data or system functions.
Yes, a patch is available. Users should update to the fixed version of the Android Framework Base package to mitigate this vulnerability.
If you cannot apply the patch immediately, it is recommended to disable companion application features as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
