Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Android MMS service may expose other users' files

CVE-2025-48591 · published 11 months ago
Summary

The Android messaging component can let one app read files belonging to another user because a permission check is missing. This could allow private data to be accessed without any user interaction or extra privileges. Apply the latest security update from Google to fix the issue.

What to do
  • Update google platform/frameworks/base to version 16-qpr2-next:2025-12-01.
  • Update google platform/packages/services/mms to version 16-qpr2-next:2025-12-01.
  • Update google platform/frameworks/base to version 15:2025-12-01.
  • Update google platform/packages/services/mms to version 15:2025-12-01.
  • Update google platform/frameworks/base to version 13:2025-12-01.
  • Update google platform/packages/services/mms to version 13:2025-12-01.
  • Update google platform/frameworks/base to version 14:2025-12-01.
  • Update google platform/packages/services/mms to version 14:2025-12-01.
Affected software
Ecosystem VendorProductAffected versions
– google android 13.0
14.0
15.0
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
Android google platform/frameworks/base >= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
>= 15:0, < 15:2025-12-01
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
Fix: upgrade to 16-qpr2-next:2025-12-01
Android google platform/packages/services/mms >= 16-qpr2-next:0, < 16-qpr2-next:2025-12-01
>= 15:0, < 15:2025-12-01
>= 13:0, < 13:2025-12-01
>= 14:0, < 14:2025-12-01
Fix: upgrade to 16-qpr2-next:2025-12-01
Original advisory text
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privil...
In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published1 Dec 2025
Updated9 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-48591 · NVD
ASB-A-305710469 · OSV
Track software like this
Free during beta