CVE-2025-48587

MEDIUM

Android - Local Denial of Service via ProfilingService Input Validation

Title source: llm

Description

In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References (2)

Core 2

Core References

Vendor Advisory

https://source.android.com/security/bulletin/2026-03-01

Vendor Advisory vendor-advisory

https://source.android.com/docs/security/bulletin/2026/2026-03-01

Scores

CVSS v3 6.2

EPSS 0.0000

EPSS Percentile 0.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (1)

google/android 16.0

Published Mar 02, 2026

Tracked Since Mar 03, 2026