deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32319
Published: 2025-12-08
Description: In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-862
References: https://android.googlesource.com/platform/frameworks/base/+/70ab82c4546aa893682a4507664dc2c471d6cd95; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-32328
Published: 2025-12-08
Description: In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/e030442861f4dd0e03d67b65f0940b488007f0d7; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-32329
Published: 2025-12-08
Description: In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/e030442861f4dd0e03d67b65f0940b488007f0d7; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48525
Published: 2025-12-08
Description: In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://android.googlesource.com/platform/frameworks/base/+/[PII_REDACTED]9e9b6119dc1cf324c395d789024908; https://android.googlesource.com/platform/frameworks/base/+/5ec1cdae1805dec292a2de[PII_REDACTED]eaa078eb; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48536
Published: 2025-12-08
Description: In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/packages/apps/Settings/+/586f8dedd8e0e8a7ca5577cd1f06891f7e84e1e1; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48555
Published: 2025-12-08
Description: In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/packages/apps/Settings/+/596c7b9911f2004df83b8d2708ad4b50e8d53805; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48564
Published: 2025-12-08
Description: In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://android.googlesource.com/platform/frameworks/base/+/0f3e248787d88154c8592f6e055b6b3586f4877d; https://android.googlesource.com/platform/frameworks/base/+/28579dff4305f764302d85f95509671eafbf62ac; https://android.googlesource.com/platform/packages/modules/IntentResolver/+/4e6cf5285d0b1725fb9141e810050cfdb3fb42fd
CVE: CVE-2025-48565
Published: 2025-12-08
Description: In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/0f3e248787d88154c8592f6e055b6b3586f4877d; https://android.googlesource.com/platform/frameworks/base/+/28579dff4305f764302d85f95509671eafbf62ac; https://android.googlesource.com/platform/packages/modules/IntentResolver/+/4e6cf5285d0b1725fb9141e810050cfdb3fb42fd
CVE: CVE-2025-48566
Published: 2025-12-08
Description: In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://android.googlesource.com/platform/frameworks/base/+/0f3e248787d88154c8592f6e055b6b3586f4877d; https://android.googlesource.com/platform/frameworks/base/+/28579dff4305f764302d85f95509671eafbf62ac; https://android.googlesource.com/platform/packages/modules/IntentResolver/+/4e6cf5285d0b1725fb9141e810050cfdb3fb42fd
CVE: CVE-2025-48572
Published: 2025-12-08
Description: In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://android.googlesource.com/platform/frameworks/base/+/e707f[PII_REDACTED]f9c67dc023c09f4cd2fc59192; https://source.android.com/security/bulletin/2025-12-01; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48572
CVE: CVE-2025-48573
Published: 2025-12-08
Description: In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use abuse. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://android.googlesource.com/platform/frameworks/base/+/039030a6b0e7d255af70609a3607e805ad2a99ff; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48575
Published: 2025-12-08
Description: In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://android.googlesource.com/platform/packages/apps/CertInstaller/+/d688ebdbfd404df1e25654bfdf9e790ad9f0db3c; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48576
Published: 2025-12-08
Description: In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://android.googlesource.com/platform/frameworks/base/+/b812baa1463c9f9e81efa617c9d08ed7a63488b4; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48580
Published: 2025-12-08
Description: In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/eb19b27ed8abe9070df9fb85bc9693c8d4ba321b; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48583
Published: 2025-12-08
Description: In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/02751bc65824a3877bdc21d865cd801b5e9f5e6c; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48584
Published: 2025-12-08
Description: In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://android.googlesource.com/platform/frameworks/base/+/08a0766708db2071d9b8b65abf40d7e8057daaa1; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48586
Published: 2025-12-08
Description: In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-441
References: https://android.googlesource.com/platform/packages/services/Telephony/+/851fc787e96189a37f88cb9eaa[PII_REDACTED]57c3; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48588
Published: 2025-12-08
Description: In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/cabbb7da639520633ad318655d1b5fe1c685c78e; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48589
Published: 2025-12-08
Description: In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user  due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/2aeba76a58c18f66502ecbba4c2e73a8d6e2928c; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48590
Published: 2025-12-08
Description: In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://android.googlesource.com/platform/frameworks/base/+/848f[PII_REDACTED]67dba98069ea33531a2f180373; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48591
Published: 2025-12-08
Description: In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://android.googlesource.com/platform/frameworks/base/+/3df02a7df8488e04e31ae1d9d081ed1b881dd6ad; https://android.googlesource.com/platform/packages/services/Mms/+/43ca1053f0a09b6fd1503caaecb62967a497b554; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48592
Published: 2025-12-08
Description: In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-122
References: https://android.googlesource.com/platform/frameworks/av/+/8febdebcb5e8736ec013a7d64e70f50e87649b52; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48594
Published: 2025-12-08
Description: In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://android.googlesource.com/platform/frameworks/base/+/ea2bcc66534263fac4c337f1a5149704c2262169; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48596
Published: 2025-12-08
Description: In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://android.googlesource.com/platform/frameworks/native/+/6ffdde944d4e0b440b1dfc1f[PII_REDACTED]00e039; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48597
Published: 2025-12-08
Description: In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021, CWE-1021
References: https://android.googlesource.com/platform/frameworks/base/+/68170bad52250399d2e4a1a8023a3e7aeda1887d; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48598
Published: 2025-12-08
Description: In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-610, CWE-441
References: https://android.googlesource.com/platform/packages/apps/Settings/+/83447688f8e3e8f009f1e7d275a14ea00ee7953a; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48599
Published: 2025-12-08
Description: In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://android.googlesource.com/platform/packages/apps/Settings/+/7a792e0b8f68bc4aeb939af703790fd76b51ccbd; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48600
Published: 2025-12-08
Description: In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://android.googlesource.com/platform/packages/modules/IntentResolver/+/bbe2dc3fb85fac9053b427b6d3c4af3506e0d9b4; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48601
Published: 2025-12-08
Description: In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48603
Published: 2025-12-08
Description: In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-400
References: https://android.googlesource.com/platform/frameworks/base/+/b4c6786312a217ad9dfd97041b2f1e2f77e39b94; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48604
Published: 2025-12-08
Description: In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://android.googlesource.com/platform/packages/services/Mms/+/c60a828b9fa18f67260775a46c752f353fcc0d43; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48607
Published: 2025-12-08
Description: In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/platform/frameworks/base/+/03d[PII_REDACTED]c961df09dec301d8a1e982ee231; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48610
Published: 2025-12-08
Description: In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://android.googlesource.com/kernel/common/+/19fbea[PII_REDACTED]0731f4b458d7e20d05777729; https://android.googlesource.com/kernel/common/+/cac44a0bcfc58c85082b13220b4adcac43ccf369; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48612
Published: 2025-12-08
Description: In multiple locations, there is a possible way for an application on a work profile to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://android.googlesource.com/platform/packages/apps/Settings/+/aa744e8988f0e7b77a71087edd4d2546b58d2f24; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48614
Published: 2025-12-08
Description: In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This could lead to physical denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://android.googlesource.com/platform/frameworks/base/+/ec0c32ea736ba3c594352c345358a778334bc773; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48615
Published: 2025-12-08
Description: In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-770, CWE-400
References: https://android.googlesource.com/platform/frameworks/base/+/a5795fc0cf1f21da88cf05ad06610d3653d1be0e; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48618
Published: 2025-12-08
Description: In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://android.googlesource.com/platform/frameworks/opt/telephony/+/fee68bcdcf029e8f40980616d[PII_REDACTED]4bc62; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48620
Published: 2025-12-08
Description: In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
References: https://android.googlesource.com/platform/frameworks/base/+/84dd2b90f4a2ea1ebc5b78f08f14c5a3b92c9c2d; https://android.googlesource.com/platform/frameworks/base/+/db86972777c84a386d8a6d2d34879923bdbccdf6; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48621
Published: 2025-12-08
Description: In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1188, CWE-1188
References: https://android.googlesource.com/platform/frameworks/base/+/6d1697c96c5cae5062f6aea58cf2665b7d646cb8; https://android.googlesource.com/platform/frameworks/native/+/cc34c7b416b964c05a42ae3e9c2929b59b92c64f; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48622
Published: 2025-12-08
Description: In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://android.googlesource.com/platform/cts/+/1bcf948f5e555ad7b9b54549698c3e569d7a0af5; https://android.googlesource.com/platform/external/dng_sdk/+/de700ad461e35af50b28b861943a0b0753b10929; https://android.googlesource.com/platform/external/skia/+/40c3f0a50fb9b47f543be0949f9004e77510f494
CVE: CVE-2025-48623
Published: 2025-12-08
Description: In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20, CWE-787
References: https://android.googlesource.com/kernel/common/+/3b6fab0ff24f7108c71a4d9c12567455cb2a5a81; https://android.googlesource.com/kernel/common/+/e76cff4952af4ac4652dc74ffbd134ff57c47895; https://source.android.com/security/bulletin/2025-12-01
CVE: CVE-2025-48624
Published: 2025-12-08
Description: In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20, CWE-787
References: https://android.googlesource.com/kernel/common/+/0668e45a43398a07c3aa2ae[PII_REDACTED]7efd87e; https://source.android.com/security/bulletin/2025-12-01