CVE-2025-48651

MediumCVSS 5.5/10Last modified Sep 8, 2026

Description

In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Apr 6, 2026
Last modified: Sep 8, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-486527.8In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This coul CVE-2025-486537.8In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could CVE-2025-486547.8In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to l CVE-2025-48668.8A vulnerability was found in weibocom rill-flow 0.1.18. It has been classified as critical. Affected is an unknown function of the component CVE-2025-48676.5A vulnerability was found in Tenda A15 15.13.07.13. It has been declared as problematic. Affected by this vulnerability is the function form CVE-2025-48686.3A vulnerability was found in merikbest ecommerce-spring-reactjs up to 464e610bb11cc2619cf6ce8212ccc2d1fd4277fd. It has been rated as critica CVE-2025-48699.8A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. This affects an unknown part of the CVE-2025-486956.4An issue was discovered in CyberDAVA before 1.1.20. A privilege escalation vulnerability allows a low-privileged user to escalate their priv CVE-2025-48709.8A vulnerability classified as critical was found in itsourcecode Restaurant Management System 1.0. This vulnerability affects unknown code o CVE-2025-487006.1An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zi CVE-2025-487015.4openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.CVE-2025-487039.0CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in t