- High 8.4
- Known exploited (CISA KEV)
CVE-2025-48595
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Scores
The facts
- Published
- 1 June 2026
- Last changed
- 22 July 2026
- NVD status
- Analyzed
- Severity
- High, CVSS 8.4 out of 10 (version 3.1)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- Affects
- google android
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 2 June 2026.
- EPSS
- 1.7% chance of exploitation activity in the next 30 days (percentile 77).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.