CVE-2025-48590

MEDIUM

Android - Denial of Service via Resource Exhaustion in AppOpsService

Title source: llm

Description

In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

References (2)

Core 2

Core References

Patch, Product

https://android.googlesource.com/platform/frameworks/base/+/848f944921756467dba98069ea33531a2f180373

Vendor Advisory

https://source.android.com/security/bulletin/2025-12-01

Scores

CVSS v3 5.5

EPSS 0.0001

EPSS Percentile 0.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (4)

google/android 13.0

google/android 14.0

google/android 15.0

google/android 16.0

Published Dec 08, 2025

Tracked Since Feb 18, 2026