CVE-2025-48645: Android Frameworks Base - Local Escalation of Privilege Due to Improper Input Validation
Summary
CVE-2025-48645: In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. Affects platform/frameworks/base across 5 version ranges.
>= 14:0, < 14:2026-03-01
>= 15:0, < 15:2026-03-01
>= 16:0, < 16:2026-03-01
>= 16-qpr2:0, < 16-qpr2:2026-03-01
>= 16-qpr2-next:0, < 16-qpr2-next:2026-03-01
Fixed in 16-qpr2-next:2026-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Frameworks Base package is a core component of the Android operating system, providing essential functionalities for application development and device management. It includes various classes and interfaces that facilitate communication between applications and the underlying hardware. This package is critical for device administration, allowing apps to manage device policies and configurations. However, it is susceptible to vulnerabilities that can lead to security breaches, particularly in the context of device administration.
Vulnerability Detail
The vulnerability identified as CVE-2025-48645 arises from improper input validation in the 'loadDescription' method of the DeviceAdminInfo.java file. This flaw allows an attacker to exploit the system without requiring additional execution privileges or user interaction. The potential ramifications include local escalation of privileges, enabling unauthorized access to sensitive device features and data. The vulnerability affects multiple versions of the Android Frameworks Base package, making it a significant security concern for devices running affected versions.
How To Fix
Minimum fixed version
16-qpr2-next:2026-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
In summary, CVE-2025-48645 represents a significant security vulnerability within the Android Frameworks Base package, allowing local escalation of privileges due to improper input validation. It is crucial for developers and users to update their systems to the patched versions to protect against potential exploitation.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48645 is a vulnerability in the Android Frameworks Base package that allows local escalation of privileges due to improper input validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive device features and data, which could lead to further exploitation of the device.
You can update the package by following the provided links to the patched versions and applying the updates in your development environment.
No, user interaction is not needed for exploitation, making it particularly dangerous.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
