CVE-2025-48611

CRITICALImmediate

Published:Mar 10, 2026(2 months ago)

Modified:Mar 16, 2026

Remote ExploitNo Auth RequiredNo InteractionScope ChangesLow Complexity

Vulnerability Description

In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Attack Characteristics

Network AccessLow ComplexityNo Auth NeededNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

Timeline

Published
CVE disclosed publicly
Mar 10, 20262 months ago
Last Modified
Most recent update
Mar 16, 20262 months ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20262 months ago

References

https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-0...

CVSS Score

v3.1

10.0/ 10.0

CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

At a Glance

Affected Products

References

Official Sources

CVSS v3 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

Impact

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVE-2025-48611

✦ Vulnerability Description

Attack Characteristics

Timeline

References

CVSS Score

At a Glance

Official Sources

CVSS v3 Vector

Impact Analysis

Vulnerability Description