CVE-2025-48603: Android Framework InputMethodInfo Denial of Service Vulnerability
Summary
CVE-2025-48603: In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android framework is a software stack for mobile devices that includes an operating system, middleware, and key applications. It provides a rich application framework that allows developers to build innovative apps and games for mobile devices. The InputMethodInfo class is part of the Android input method framework, which manages input methods for text entry. This class is essential for enabling various input methods, such as keyboards and voice input, to interact with applications. However, a vulnerability in this class can lead to severe issues, particularly in terms of resource management.
Vulnerability Detail
The vulnerability identified as CVE-2025-48603 exists in the InputMethodInfo class of the Android framework. It is characterized as a permanent denial of service (DoS) due to resource exhaustion. This means that an attacker could exploit this vulnerability to consume system resources, leading to a situation where legitimate users cannot access the input methods. The vulnerability does not require any additional execution privileges or user interaction, making it particularly dangerous. The affected versions include Android 13, 14, 15, and 16, with specific patches available for each version.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patches as soon as they are available to mitigate the risk.
Conclusion
CVE-2025-48603 is a critical vulnerability in the Android framework that can lead to denial of service due to resource exhaustion. It is essential for users to update their systems to the patched versions to protect against potential exploitation. Regular monitoring and updating of software are crucial for maintaining security.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48603 is a vulnerability in the Android framework's InputMethodInfo class that can lead to a permanent denial of service due to resource exhaustion.
If you are using Android versions 13, 14, 15, or 16, you may be affected by this vulnerability. Check your version in the settings under 'About phone'.
You should update your Android framework to the latest patched version as soon as possible to mitigate the risk of exploitation.
No, user interaction is not required for exploitation, making this vulnerability particularly dangerous.
You can find more information about CVE-2025-48603 on the official Android security bulletin or by using tools like Vulert to monitor your application for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
