CVE-2025-48633: Android Framework Information Disclosure Vulnerability
Android · Framework · NVD published 2025-12-08 · posted 2025-12-02 · last modified 2026-10-08
What it is
In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
| Weakness | Not specified |
|---|---|
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (source: [email protected]) |
| CISA due date | 2025-12-23 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | n/a |
Exploitation evidence
First exploit evidence seen: 2025-12-02 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2025-12-02. Source
Sources: CISA KEV.
No ATT&CK techniques could be mapped or inferred for this CVE yet.
How to fix it
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)
Fixed versions
NVD does not list a fixed version for this CVE. Use the vendor advisory below.
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://source.android.com/docs/security/bulletin/2025-12-01 (CISA KEV notes)
- https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93 (Patch, Product)
- https://source.android.com/security/bulletin/2025-12-01 (Vendor Advisory)
Detection Generic guidance
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.