CVE-2025-48610

In pkvmguestrelinquishtohost of memprotect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48607

In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48607

In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48604

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48604

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48603

In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48603

Technical details are not publicly available in the provided documents for CVE-2025-48603; monitor for updates as more data may be published by vendors and trackers.

CVE-2025-48601

Technical details (affected products, exact root cause, and fixes) are not publicly disclosed in the provided documents. Monitor for updates from the listed sources.

CVE-2025-48600

In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48598

In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48598

Technical details (affected products, vulnerable components, fixes) are not provided in the connected documents. Monitor for updates from vendors (Android, Red Hat, ENISA OSV) for concrete impact, affected products, and patches.

CVE-2025-48597

CVE-2025-48597 is an Android Framework–level tapjacking/overlay vulnerability that could enable local privilege escalation without user interaction. Reported details indicate the issue affects Android Framework components and is addressed via Android security patches at patch levels 2025-12-01 / ...

CVE-2025-48597

In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48596

In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48596

CVE-2025-48596 is an Android/local privilege-escalation flaw caused by an out-of-bounds read in Parcel.cpp:appendFrom due to a missing bounds check. The issue allows local escalation without extra privileges or user interaction. Public references and Red Hat/EUVD/NVD entries describe the same aff...

CVE-2025-48592

In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48591

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48591

Google Android is impacted by a security vulnerability where a missing permission check in multiple locations allows for the reading of files belonging to another user. This flaw can result in local information disclosure of sensitive data. Exploitation does not require additional execution privi...

CVE-2025-48590

In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is...

CVE-2025-48589

A logic error in multiple functions of HeaderPrivacyIconsController.kt within the Android Framework component allows for a local escalation of privilege . This vulnerability could enable a malicious actor to grant permissions across users without requiring additional execution privileges or user ...