CVE-2025-48614

MediumCVSS 4.6/10Last modified Oct 7, 2026

Description

In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This could lead to physical denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
GoogleAndroid16; 15; 14; 13

References

Timeline

Published
Dec 8, 2025
Last modified
Oct 7, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-486157.8In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could leadCVE-2025-486163.3In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic erroCVE-2025-486177.8In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to lCVE-2025-486186.8In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. TCVE-2025-486198.4In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic errCVE-2025-48626.1A vulnerability, which was classified as problematic, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue iCVE-2025-486207.8In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to pCVE-2025-486217.3In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local CVE-2025-486225.5In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local informatioCVE-2025-486237.8In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalatiCVE-2025-486247.8In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local eCVE-2025-486257.0In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race
CVE-2025-48614: Medium severity, CVSS 4.6 | Vulnix