Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2025-48637: Android and Linux kernel may allow local privilege gain
CVE-2025-48637 · published 11 months ago
Summary
A coding error in the memory protection component of Android and the Linux kernel could let a local user write data outside intended boundaries, potentially increasing their system rights. This does not require any special user interaction or additional privileges to exploit. Apply the latest security updates from Google and your Linux distribution to fix the issue.
What to do
- Update google :linux_kernel: to version :2025-12-05.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | android |
All versions
cpe:2.3:o:google:android:-:*:*:*:*:*:*:* |
|
| Android | :linux_kernel: |
>= :0, < :2025-12-05 Fix: upgrade to :2025-12-05
|
Original advisory text
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges ...
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-190Integer Overflow
Timeline
Published1 Dec 2025
Updated9 Oct 2026
First seen7 Mar 2026
Track software like this
Free during beta