CVE-2025-48603

MediumCVSS 5.5/10Last modified Oct 7, 2026

Description

In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770CWE-400

Affected software

VendorProductVersions
GoogleAndroid16; 15; 14; 13

References

Timeline

Published
Dec 8, 2025
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-486045.5In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local iCVE-2025-486058.4In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead CVE-2025-486067.8In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism toCVE-2025-486075.5In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to locaCVE-2025-486085.5In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead toCVE-2025-486099.1In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionCVE-2025-48619.8A vulnerability classified as critical was found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unCVE-2025-486105.5In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This coulCVE-2025-486117.8In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation oCVE-2025-486127.8In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment settiCVE-2025-486137.8In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the CVE-2025-486144.6In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permiss