CVE-2025-48609: TelephonyProvider Package Vulnerability Leading to Arbitrary File Deletion
Summary
CVE-2025-48609: In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. Affects platform/packages/providers/TelephonyProvider across 4 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TelephonyProvider package is an integral component of the Android ecosystem, responsible for managing telephony, SMS, and MMS functionalities. It enables applications to send and receive messages, manage contacts, and handle multimedia messaging. This package is crucial for communication on Android devices, and any vulnerabilities can severely impact user experience and data integrity.
Vulnerability Detail
In multiple functions of MmsProvider.java, there exists a path traversal error that allows for arbitrary file deletion. This vulnerability can lead to a local denial of service, affecting telephony, SMS, and MMS functionalities without requiring additional execution privileges or user interaction. The flaw arises from improper validation of file paths, enabling attackers to manipulate file access and delete critical files.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that file paths are validated before any deletion operations are performed. Implement checks to restrict file access to only authorized directories, preventing unauthorized file manipulations.
Conclusion
The CVE-2025-48609 vulnerability in the TelephonyProvider package poses a serious risk by allowing arbitrary file deletion. It is crucial to update to the patched version to safeguard against potential exploitation. Regular monitoring and validation of file access can further enhance security.
See every vulnerability recorded for platform/packages/providers/TelephonyProvider →
FAQ
CVE-2025-48609 is a vulnerability in the TelephonyProvider package that allows for arbitrary file deletion due to a path traversal error.
This vulnerability can lead to a denial of service, disrupting SMS and MMS functionalities, and potentially causing loss of important data.
No, user interaction is not needed for exploitation, making it a significant security risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Update the TelephonyProvider package to the latest patched version as outlined in the 'how to fix' section to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/providers/TelephonyProvider.
