CVE-2025-48628: Android Framework PrintManagerService Cross-User Image Leak Vulnerability
Summary
CVE-2025-48628: In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. Affects platform/frameworks/base across 5 version ranges.
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
>= 15:0, < 15:2025-12-01
>= 16:0, < 16:2025-12-01
>= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
Fixed in 16-qpr2-next:2025-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android framework is a software stack that includes a set of libraries and APIs for building applications on the Android operating system. The PrintManagerService is a critical component that manages print jobs and printer settings. This service allows applications to interact with printers and handle print requests. However, a vulnerability has been identified in this service that could lead to unauthorized access to user images across different user accounts.
Vulnerability Detail
In the PrintManagerService.java file, specifically in the validateIconUserBoundary function, there exists a flaw that allows for a cross-user image leak due to a confused deputy problem. This vulnerability can lead to local escalation of privilege without requiring additional execution privileges. It poses a significant risk as it can expose sensitive user images to other users on the same device, potentially leading to privacy violations.
How To Fix
Minimum fixed version
16-qpr2-next:2025-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is strongly recommended to apply the patches as soon as they are available.
Conclusion
The CVE-2025-48628 vulnerability in the Android framework's PrintManagerService poses a significant risk of cross-user image leaks, potentially compromising user privacy. It is essential to update to the patched versions to secure the affected systems.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48628 is a vulnerability in the Android framework's PrintManagerService that allows for cross-user image leaks.
This vulnerability can lead to unauthorized access to user images by other users on the same device, compromising user privacy.
Versions 13, 14, 15, and 16 of the Android framework are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
