CVE-2025-48594

HighCVSS 7.3/10Last modified Oct 7, 2026

Description

In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Dec 8, 2025
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-485958.4In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of CVE-2025-485967.8In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of prCVE-2025-485977.8In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could leCVE-2025-485986.6In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead toCVE-2025-485997.8In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permissioCVE-2025-48604.8A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of tCVE-2025-486005.5In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local inCVE-2025-486015.5In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalationCVE-2025-486028.4In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic erroCVE-2025-486035.5In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to lCVE-2025-486045.5In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local iCVE-2025-486058.4In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead
CVE-2025-48594: High severity, CVSS 7.3 | Vulnix