CVE-2025-48593

Published Nov 18, 2025

Last updated a month ago

Android System

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-48593 is a critical zero-click vulnerability in the Android System component that manages essential device functions. It allows attackers to remotely execute malicious code without any user interaction or additional privileges. The vulnerability stems from insufficient validation of user input and affects Android versions 13 through 16. Successful exploitation of CVE-2025-48593 could give attackers full control over affected devices, potentially leading to data theft, ransomware deployment, or the use of compromised smartphones as nodes in botnet attacks. Google has released a security patch in the November 2025 Android Security Bulletin to address this vulnerability.

Description: In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
Source: security@android.com
NVD status: Analyzed
Products: android

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8
Impact score: 5.9
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-416

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469"
          },
          {
            "criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D"
          },
          {
            "criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E"
          },
          {
            "criteria": "cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2D49E611-5D53-479D-A981-42388FDC0E8D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.