CVE-2025-48595 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-48595HIGH

Google Android — Android Framework

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   N  U  H  H  H    8.4   .0171   75.6   YES

AFFECTED
  Product  Versions   Fixed
  Android  16-qpr2 –  —

TIMELINE
  May 22  Reserved by google_android
  Jun 2   Added to CISA KEV, remediation due 2026-06-05
  Jun 2   Published (CNA: google_android)
  Jun 6   DUE DATE PASSED — CVE-2025-48595 (Google Android). CISA remediation deadline was June 5, 2026; still in catalog.
  Jul 22  ENRICHED — CVE-2025-48595 (Android Framework). Received CVSS 8.4 and CPE data from NVD.

CWE-190 · CNA: google_android · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due June 5, 2026

Description

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
May 22, 2025	Reserved	Reserved by google_android
June 2, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-06-05
June 2, 2026	Published	Published (CNA: google_android)
June 6, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2025-48595 (Google Android). CISA remediation deadline was June 5, 2026; still in catalog.
July 22, 2026	ENRICHED	ENRICHED — CVE-2025-48595 (Android Framework). Received CVSS 8.4 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Google	Android	—	16-qpr2	—

Weaknesses

CWE-190

References (2)

https://source.android.com/docs/security/bulletin/2026/2026-06-01 [Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595 [US Government Resource]

Authoritative record: CVE-2025-48595 at cve.org

Vendors: google

Weaknesses: CWE-190

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-48595 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.