CVE-2025-48581

HIGH

Android - Local Privilege Escalation via Apexd Session Overlap Logic Error

Title source: llm

Description

In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References (5)

Core 5

Core References

Patch

https://android.googlesource.com/platform/build/+/cda08bfbf55aed1e4c79efe6a66bb930d19a8a13

Patch

https://android.googlesource.com/platform/system/apex/+/13bbfe3ef2953e9805d57d3219cc122e485ba90f

Patch

https://android.googlesource.com/platform/system/apex/+/5a33fa4202cb5f06d7f02f3a2b8d13780d7cb3f5

Vendor Advisory

https://source.android.com/security/bulletin/2025-11-01

Vendor Advisory

https://source.android.com/docs/security/bulletin/2026/2026-06-01

Scores

CVSS v3 8.4

EPSS 0.0015

EPSS Percentile 5.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-754

Status published

Products (1)

google/android 16.0

Published Sep 04, 2025

Tracked Since Feb 18, 2026