CVE-2025-48648: Android Framework NotificationManagerService Denial of Service Vulnerability
Summary
CVE-2025-48648: In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. Affects platform/frameworks/base across 4 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework is a set of libraries and tools that allow developers to create applications for the Android operating system. One of its core components is the NotificationManagerService, which handles notifications for applications. This service is crucial for user engagement, allowing apps to send alerts and updates to users. However, it is susceptible to vulnerabilities that can lead to service disruptions, such as the one described in this report.
Vulnerability Detail
In the NotificationManagerService.java file, the isSameApp function has a flaw that can lead to a persistent denial of service (DoS) due to resource exhaustion. This vulnerability allows an attacker to exploit the service without requiring additional execution privileges or user interaction. If successfully exploited, it can cause the affected device to become unresponsive to notifications, severely impacting user experience and application functionality.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the number of notifications sent by applications or disable notifications for specific apps until the patch is applied. This can be done through the device settings under 'Apps & notifications'.
Conclusion
The CVE-2025-48648 vulnerability in the Android Framework's NotificationManagerService poses a significant risk of denial of service due to resource exhaustion. It is crucial for developers and users to apply the available patches promptly to mitigate this risk and ensure the smooth functioning of applications.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2025-48648 is a vulnerability in the Android Framework's NotificationManagerService that can lead to a denial of service due to resource exhaustion.
Exploitation of this vulnerability can cause your device to become unresponsive to notifications, impacting the functionality of applications that rely on the notification system.
No, user interaction is not required to exploit this vulnerability, making it particularly concerning.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update your package immediately, consider limiting notifications from affected applications or disabling notifications temporarily.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
