{"id":"ASB-A-325030433","details":"In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-325030433","CVE-2025-48529"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/f33f9ef6467b0c9c4e1fbb7b2449c8b46b9792a3"}],"affected":[{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20","target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java","function":"setRingtoneUri"},"deprecated":false,"digest":{"length":251,"function_hash":"133031434479216099194307905452406260201"},"id":"ASB-A-325030433-1c6cfd11"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20","target":{"function":"getRingTonePreference","file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"function_hash":"306687027296355637922132806271758282101","length":296},"id":"ASB-A-325030433-48b184da"},{"target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"line_hashes":["248671716584057300785462213278131389134","263515044525166302535215884960551402106","279921214816236382063408277335479350610","75959860967272893104544807511879207729","250192583294005125257913726570220402478","58838851214741234154771278895414228819","152005111570825911847066526519511613284","18337771855077075187570844051959333783","14769223577195532185019027311875908450","177951331207846869576424443456142754959","258400268766178781577269273409943615382","278688330813352352868510681390862952067","253415492431726145069546772472895670183","172695401327264267241615279259175691141","238051197396264627135955887937578994219","67539921850361608969104389796797552858","259475632868274863456527577971635323897","305691977004525890984829261053864051","216290257123844451646771943976359675110","271437640484680005869636960705871224356","3274114120089772416315707768767429794","180147887889154742401429707933158294619","125430637473330956441203003579781052746","95500207018634963090715657447010122062","162021703766761516144788973274417396627","252538717735571485483837766430479159769","329941963891357385557172251545687632370","152919738203697197512909211769250164626"],"threshold":0.9},"id":"ASB-A-325030433-6545df58","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20"},{"target":{"file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java","function":"migrateVoicemailNotificationSettings"},"deprecated":false,"digest":{"function_hash":"71679360428432379506423741355863132513","length":581},"id":"ASB-A-325030433-8e84a11b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20"},{"digest":{"line_hashes":["154236477835906654517993517806808105038","113444643295855590800201893739480848443","174051193066396634707122360605385417157","106049811260593264175438614703638396776","299630838548443073013715267021770912032","289359924979266531862205035438719540820","100249978342859389425886031064290288606","308635386750701990348137436806048872029","7936512274775870169851420279471967701","331849017987102178318115310637151247351","161031963099252491738342096228047382642","27520099346840307313956488025617925505","241074073288632596402560024690577478300","173710053643114438002372541439012670502"],"threshold":0.9},"id":"ASB-A-325030433-ede803ae","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20","target":{"file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/8e47af093625b997ffb8ca0379a4a56c02ddeb20"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-325030433.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-325030433-20392c89","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14","target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java","function":"getRingTonePreference"},"deprecated":false,"digest":{"length":296,"function_hash":"306687027296355637922132806271758282101"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14","target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["248671716584057300785462213278131389134","263515044525166302535215884960551402106","279921214816236382063408277335479350610","75959860967272893104544807511879207729","250192583294005125257913726570220402478","58838851214741234154771278895414228819","152005111570825911847066526519511613284","18337771855077075187570844051959333783","14769223577195532185019027311875908450","177951331207846869576424443456142754959","258400268766178781577269273409943615382","278688330813352352868510681390862952067","253415492431726145069546772472895670183","172695401327264267241615279259175691141","238051197396264627135955887937578994219","67539921850361608969104389796797552858","259475632868274863456527577971635323897","305691977004525890984829261053864051","216290257123844451646771943976359675110","271437640484680005869636960705871224356","3274114120089772416315707768767429794","180147887889154742401429707933158294619","125430637473330956441203003579781052746","95500207018634963090715657447010122062","162021703766761516144788973274417396627","252538717735571485483837766430479159769","329941963891357385557172251545687632370","152919738203697197512909211769250164626"]},"id":"ASB-A-325030433-22411b9a"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14","target":{"file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"},"deprecated":false,"digest":{"line_hashes":["154236477835906654517993517806808105038","113444643295855590800201893739480848443","174051193066396634707122360605385417157","106049811260593264175438614703638396776","299630838548443073013715267021770912032","289359924979266531862205035438719540820","100249978342859389425886031064290288606","308635386750701990348137436806048872029","7936512274775870169851420279471967701","331849017987102178318115310637151247351","161031963099252491738342096228047382642","27520099346840307313956488025617925505","241074073288632596402560024690577478300","173710053643114438002372541439012670502"],"threshold":0.9},"id":"ASB-A-325030433-3a6b7cf6"},{"target":{"function":"migrateVoicemailNotificationSettings","file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"},"deprecated":false,"digest":{"function_hash":"71679360428432379506423741355863132513","length":581},"id":"ASB-A-325030433-3d405cf6","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14"},{"target":{"function":"setRingtoneUri","file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"length":251,"function_hash":"133031434479216099194307905452406260201"},"id":"ASB-A-325030433-6d0a81bd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/08dca76eb669e54299ce96590a041175b4ec1f14"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-325030433.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"line_hashes":["248671716584057300785462213278131389134","263515044525166302535215884960551402106","279921214816236382063408277335479350610","75959860967272893104544807511879207729","250192583294005125257913726570220402478","58838851214741234154771278895414228819","152005111570825911847066526519511613284","18337771855077075187570844051959333783","14769223577195532185019027311875908450","177951331207846869576424443456142754959","258400268766178781577269273409943615382","278688330813352352868510681390862952067","253415492431726145069546772472895670183","172695401327264267241615279259175691141","238051197396264627135955887937578994219","67539921850361608969104389796797552858","259475632868274863456527577971635323897","305691977004525890984829261053864051","216290257123844451646771943976359675110","271437640484680005869636960705871224356","3274114120089772416315707768767429794","180147887889154742401429707933158294619","125430637473330956441203003579781052746","95500207018634963090715657447010122062","162021703766761516144788973274417396627","252538717735571485483837766430479159769","329941963891357385557172251545687632370","152919738203697197512909211769250164626"],"threshold":0.9},"id":"ASB-A-325030433-0304bb8a","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf"},{"deprecated":false,"digest":{"function_hash":"133031434479216099194307905452406260201","length":251},"id":"ASB-A-325030433-0b867f4c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf","target":{"function":"setRingtoneUri","file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"}},{"target":{"function":"migrateVoicemailNotificationSettings","file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"},"deprecated":false,"digest":{"function_hash":"71679360428432379506423741355863132513","length":581},"id":"ASB-A-325030433-67eec83c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf","target":{"file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"},"deprecated":false,"digest":{"line_hashes":["154236477835906654517993517806808105038","113444643295855590800201893739480848443","174051193066396634707122360605385417157","106049811260593264175438614703638396776","299630838548443073013715267021770912032","289359924979266531862205035438719540820","100249978342859389425886031064290288606","308635386750701990348137436806048872029","7936512274775870169851420279471967701","331849017987102178318115310637151247351","161031963099252491738342096228047382642","27520099346840307313956488025617925505","241074073288632596402560024690577478300","173710053643114438002372541439012670502"],"threshold":0.9},"id":"ASB-A-325030433-6cfc6ad2"},{"target":{"function":"getRingTonePreference","file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"function_hash":"306687027296355637922132806271758282101","length":296},"id":"ASB-A-325030433-90cbfbaf","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf"}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/4e3da1d5e019adc661ed609b3da9560cd657fbaf"],"severity":"High","spl":"2025-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-325030433.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e","target":{"function":"migrateVoicemailNotificationSettings","file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"},"deprecated":false,"digest":{"function_hash":"71679360428432379506423741355863132513","length":581},"id":"ASB-A-325030433-4a7e548b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"line_hashes":["248671716584057300785462213278131389134","263515044525166302535215884960551402106","279921214816236382063408277335479350610","75959860967272893104544807511879207729","250192583294005125257913726570220402478","58838851214741234154771278895414228819","152005111570825911847066526519511613284","18337771855077075187570844051959333783","14769223577195532185019027311875908450","177951331207846869576424443456142754959","258400268766178781577269273409943615382","278688330813352352868510681390862952067","253415492431726145069546772472895670183","172695401327264267241615279259175691141","238051197396264627135955887937578994219","67539921850361608969104389796797552858","259475632868274863456527577971635323897","305691977004525890984829261053864051","216290257123844451646771943976359675110","271437640484680005869636960705871224356","3274114120089772416315707768767429794","180147887889154742401429707933158294619","125430637473330956441203003579781052746","95500207018634963090715657447010122062","162021703766761516144788973274417396627","252538717735571485483837766430479159769","329941963891357385557172251545687632370","152919738203697197512909211769250164626"],"threshold":0.9},"id":"ASB-A-325030433-4eb3e323","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e"},{"id":"ASB-A-325030433-53739c96","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e","target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java","function":"getRingTonePreference"},"deprecated":false,"digest":{"length":296,"function_hash":"306687027296355637922132806271758282101"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e","target":{"file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"},"deprecated":false,"digest":{"line_hashes":["154236477835906654517993517806808105038","113444643295855590800201893739480848443","174051193066396634707122360605385417157","106049811260593264175438614703638396776","299630838548443073013715267021770912032","289359924979266531862205035438719540820","100249978342859389425886031064290288606","308635386750701990348137436806048872029","7936512274775870169851420279471967701","331849017987102178318115310637151247351","161031963099252491738342096228047382642","27520099346840307313956488025617925505","241074073288632596402560024690577478300","173710053643114438002372541439012670502"],"threshold":0.9},"id":"ASB-A-325030433-b766ed02"},{"deprecated":false,"digest":{"function_hash":"133031434479216099194307905452406260201","length":251},"id":"ASB-A-325030433-db7a1955","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e","target":{"function":"setRingtoneUri","file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/fbe456f9ec42cc1293d023c329e35be83d7cf66e"],"severity":"High","spl":"2025-09-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-325030433.json"}},{"package":{"name":"platform/frameworks/opt/telephony","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["ID"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b","target":{"function":"getRingTonePreference","file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"function_hash":"306687027296355637922132806271758282101","length":296},"id":"ASB-A-325030433-144d4562"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b","target":{"file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java","function":"migrateVoicemailNotificationSettings"},"deprecated":false,"digest":{"function_hash":"71679360428432379506423741355863132513","length":581},"id":"ASB-A-325030433-2a6b061a"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b","target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java"},"deprecated":false,"digest":{"line_hashes":["248671716584057300785462213278131389134","263515044525166302535215884960551402106","279921214816236382063408277335479350610","75959860967272893104544807511879207729","250192583294005125257913726570220402478","58838851214741234154771278895414228819","152005111570825911847066526519511613284","18337771855077075187570844051959333783","14769223577195532185019027311875908450","177951331207846869576424443456142754959","258400268766178781577269273409943615382","278688330813352352868510681390862952067","253415492431726145069546772472895670183","172695401327264267241615279259175691141","238051197396264627135955887937578994219","67539921850361608969104389796797552858","259475632868274863456527577971635323897","305691977004525890984829261053864051","216290257123844451646771943976359675110","271437640484680005869636960705871224356","3274114120089772416315707768767429794","180147887889154742401429707933158294619","125430637473330956441203003579781052746","95500207018634963090715657447010122062","162021703766761516144788973274417396627","252538717735571485483837766430479159769","329941963891357385557172251545687632370","152919738203697197512909211769250164626"],"threshold":0.9},"id":"ASB-A-325030433-5d4ea2e7","signature_type":"Line"},{"digest":{"function_hash":"133031434479216099194307905452406260201","length":251},"id":"ASB-A-325030433-7013d694","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b","target":{"file":"src/java/com/android/internal/telephony/util/VoicemailNotificationSettingsUtil.java","function":"setRingtoneUri"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["154236477835906654517993517806808105038","113444643295855590800201893739480848443","174051193066396634707122360605385417157","106049811260593264175438614703638396776","299630838548443073013715267021770912032","289359924979266531862205035438719540820","100249978342859389425886031064290288606","308635386750701990348137436806048872029","7936512274775870169851420279471967701","331849017987102178318115310637151247351","161031963099252491738342096228047382642","27520099346840307313956488025617925505","241074073288632596402560024690577478300","173710053643114438002372541439012670502"]},"id":"ASB-A-325030433-eb3281aa","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b","target":{"file":"src/java/com/android/internal/telephony/util/NotificationChannelController.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/opt/telephony/+/d656d1fd97855120fad78f7f965d12b37f20017b"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-325030433.json"}}],"schema_version":"1.9.0"}