In multiple locations

CVE-2025-48595 is an Android Framework integer overflow that can be turned into code execution and local privilege escalation with no extra privileges and no user interaction once the attacker has code running on the device. Google lists affected AOSP versions as Android 14, 15, 16, and 16-qpr2, and the fix is included in the June 1, 2026 Android security patch level or later.

The vendor's HIGH 8.4 is directionally right, but the raw CVSS still overstates broad enterprise blast radius because AV:L means this is not an internet-reachable initial-access bug. The thing that keeps it firmly important is not the math bug itself; it is the combination of KEV listing, Google's note of limited targeted exploitation, and Android's long-tail patch lag across OEM fleets.

Why this verdict

• Downgrade for attacker position: AV:L requires local code execution on the handset, so this is post-initial-access, not a remotely reachable fleet-wide breach primitive.
• Downward pressure from exposure population: only Android 14/15/16/16-qpr2 devices are affected, and only the subset that are both unpatched and meaningful corporate access devices matter operationally.
• Upward pressure from exploitation evidence: Google says exploitation is already occurring and CISA added it to KEV on 2026-06-02, which outweighs the very low EPSS signal.
• Downward pressure from operational friction: mobile app controls, Play Protect, MDM allowlists, and work-profile policies block many commodity delivery paths that would otherwise make a local EoP far worse.
• Upward pressure from business impact: on a compromised work device, successful LPE can unlock mailbox, chat, tokens, and identity artifacts that turn one phone compromise into broader enterprise access abuse.

Why not higher?

This is not CRITICAL because there is no evidence the CVE itself provides unauthenticated remote reachability, wormability, or broad one-to-many blast radius. The attacker must already have a foothold on each target device, and exploit reliability in Android land is usually build- and OEM-sensitive.

Why not lower?

This is not MEDIUM or LOW because the exploitation question is already settled: KEV-listed plus Google's targeted exploitation note means real adversaries found value here. On enterprises that allow Android access to mail, chat, SSO, and MFA workflows, a single-device local EoP can produce outsized identity and data impact.

1. Block sideloading — Disable unknown-source installs and tighten enterprise app allowlists to reduce the most likely local foothold path. Because this is KEV-listed / actively exploited, deploy this immediately, within hours on managed Android populations that cannot be patched at once.
2. Enforce patch-level compliance — Use MDM / Android Enterprise compliance rules to quarantine or restrict access for devices below 2026-06-01 Android security patch level. Because this is active exploitation, apply the access gate immediately, within hours rather than waiting for the standard HIGH mitigation window.
3. Require Play Protect and mobile threat defense — Keep Google Play Protect enabled and ingest mobile threat defense telemetry to catch malicious apps and post-compromise behaviors that can serve as the prerequisite for this LPE. Enforce this immediately, within hours for any fleet that allows Android access to corporate identity or mail.
4. Limit mobile token value — Shorten session lifetime, require device-compliance checks for sensitive apps, and prefer phishing-resistant or hardware-bound auth where possible so an elevated mobile compromise yields less reusable identity material. For a HIGH finding, institutionalize these controls within 30 days, even if emergency mitigations go live sooner.
5. Quarantine stale Android builds — Create a dynamic group for Android 14/15/16 devices with patch levels earlier than 2026-06-01 and restrict them from mail, VPN, or admin portals until updated. For this KEV-backed case, start enforcement immediately, within hours.

Run this on an auditor workstation with adb installed, against a USB- or network-connected Android device. Invoke it as ./check_cve_2025_48595.sh SERIAL (example: ./check_cve_2025_48595.sh R58N12345AB) or omit the serial if only one device is attached; no root is required, but the device must allow adb shell access.

#!/usr/bin/env bash
# check_cve_2025_48595.sh
# Determine likely exposure to CVE-2025-48595 using Android version and security patch level.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=tool/runtime error

set -u

TARGET_PATCH="2026-06-01"
SERIAL="${1:-}"
ADB_BASE=(adb)
if [[ -n "$SERIAL" ]]; then
  ADB_BASE+=( -s "$SERIAL" )
fi

need_cmd() {
  command -v "$1" >/dev/null 2>&1
}

getprop_safe() {
  local prop="$1"
  "${ADB_BASE[@]}" shell getprop "$prop" 2>/dev/null | tr -d '\r'
}

normalize_patch() {
  # Accept YYYY-MM-DD only
  local p="$1"
  if [[ "$p" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
    printf '%s' "$p"
  else
    printf ''
  fi
}

main() {
  if ! need_cmd adb; then
    echo "UNKNOWN - adb not installed"
    exit 3
  fi

  if ! "${ADB_BASE[@]}" get-state >/dev/null 2>&1; then
    echo "UNKNOWN - no adb device available or unauthorized"
    exit 2
  fi

  local android_release sdk patch fingerprint model
  android_release="$(getprop_safe ro.build.version.release)"
  sdk="$(getprop_safe ro.build.version.sdk)"
  patch="$(getprop_safe ro.build.version.security_patch)"
  fingerprint="$(getprop_safe ro.build.fingerprint)"
  model="$(getprop_safe ro.product.model)"

  patch="$(normalize_patch "$patch")"

  # Affected versions per Android bulletin: 14, 15, 16, 16-qpr2.
  # We key primarily on SDK / release and then on security patch level.
  local affected_version="false"
  case "$sdk" in
    34|35|36)
      affected_version="true"
      ;;
    *)
      # Fallback to release string if SDK missing/unusual
      case "$android_release" in
        14*|15*|16*) affected_version="true" ;;
      esac
      ;;
  esac

  if [[ "$affected_version" != "true" ]]; then
    echo "PATCHED - device is not in the known affected Android 14/15/16 range (model=$model sdk=$sdk release=$android_release patch=${patch:-unknown})"
    exit 0
  fi

  if [[ -z "$patch" ]]; then
    echo "UNKNOWN - affected Android version but security patch level unavailable (model=$model sdk=$sdk release=$android_release fingerprint=$fingerprint)"
    exit 2
  fi

  if [[ "$patch" < "$TARGET_PATCH" ]]; then
    echo "VULNERABLE - affected Android version with security patch level earlier than $TARGET_PATCH (model=$model sdk=$sdk release=$android_release patch=$patch fingerprint=$fingerprint)"
    exit 1
  else
    echo "PATCHED - affected Android version but security patch level is $patch, which is >= $TARGET_PATCH (model=$model sdk=$sdk release=$android_release fingerprint=$fingerprint)"
    exit 0
  fi
}

main "$@"

Sources

1. Android Security Bulletin—June 2026
2. NVD CVE-2025-48595 entry
3. CISA KEV catalog filtered for CVE-2025-48595
4. FIRST EPSS project
5. FIRST EPSS data/statistics
6. Android Help: Check & update your Android version
7. SecurityWeek coverage of the June 2026 Android zero-day
8. Help Net Security coverage of CVE-2025-48595