{"id":"ASB-A-352518318","details":"In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-352518318","CVE-2025-48629"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-12-01"}]}],"versions":["16-next"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-352518318-33665026","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0bc6ced90e2ee1e6140a4d87ee62923bdfd2ca93","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["47274992421755207113118081743678820666","330158044124541779460596724346000588663","131171812827798739359207097202532290807","180990563501817653078404487359329241164","43478981758376090947905583906143419560","105549899352138567472247528574255276468","321325204288527415351185891004280261569","147697608984753671911282489937155901288"]}},{"target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"findAvailRecognizer"},"deprecated":false,"digest":{"function_hash":"330782152972113371377640086931920540989","length":1020},"id":"ASB-A-352518318-4af7a1f7","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/0bc6ced90e2ee1e6140a4d87ee62923bdfd2ca93"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/0bc6ced90e2ee1e6140a4d87ee62923bdfd2ca93"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352518318.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"330782152972113371377640086931920540989","length":1020},"id":"ASB-A-352518318-5345bc54","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6e831ea141ac638b7c18bac6973d484b67b7fca9","target":{"function":"findAvailRecognizer","file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"}},{"id":"ASB-A-352518318-5bba9e20","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6e831ea141ac638b7c18bac6973d484b67b7fca9","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["47274992421755207113118081743678820666","330158044124541779460596724346000588663","131171812827798739359207097202532290807","180990563501817653078404487359329241164","43478981758376090947905583906143419560","105549899352138567472247528574255276468","321325204288527415351185891004280261569","147697608984753671911282489937155901288"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6e831ea141ac638b7c18bac6973d484b67b7fca9"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352518318.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["47274992421755207113118081743678820666","330158044124541779460596724346000588663","131171812827798739359207097202532290807","180990563501817653078404487359329241164","43478981758376090947905583906143419560","105549899352138567472247528574255276468","321325204288527415351185891004280261569","147697608984753671911282489937155901288"],"threshold":0.9},"id":"ASB-A-352518318-c40c3781","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/22600e902bceab659abeb2e540c3d24c5791c238"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/22600e902bceab659abeb2e540c3d24c5791c238","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"findAvailRecognizer"},"deprecated":false,"digest":{"function_hash":"330782152972113371377640086931920540989","length":1020},"id":"ASB-A-352518318-e5f64da0","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/22600e902bceab659abeb2e540c3d24c5791c238"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352518318.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["47274992421755207113118081743678820666","330158044124541779460596724346000588663","131171812827798739359207097202532290807","180990563501817653078404487359329241164","43478981758376090947905583906143419560","105549899352138567472247528574255276468","321325204288527415351185891004280261569","147697608984753671911282489937155901288"],"threshold":0.9},"id":"ASB-A-352518318-4fa1f667","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/00055febc3040d61788991d3d0bf4f0b8106df91","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"}},{"source":"https://android.googlesource.com/platform/frameworks/base/+/00055febc3040d61788991d3d0bf4f0b8106df91","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java","function":"findAvailRecognizer"},"deprecated":false,"digest":{"function_hash":"330782152972113371377640086931920540989","length":1020},"id":"ASB-A-352518318-6899a154","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/00055febc3040d61788991d3d0bf4f0b8106df91"],"severity":"High","spl":"2025-12-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352518318.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["EoP"],"vanir_signatures":[{"target":{"function":"findAvailRecognizer","file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"function_hash":"330782152972113371377640086931920540989","length":1020},"id":"ASB-A-352518318-78cd2972","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/00055febc3040d61788991d3d0bf4f0b8106df91"},{"id":"ASB-A-352518318-c1ee5587","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/00055febc3040d61788991d3d0bf4f0b8106df91","target":{"file":"services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java"},"deprecated":false,"digest":{"line_hashes":["47274992421755207113118081743678820666","330158044124541779460596724346000588663","131171812827798739359207097202532290807","180990563501817653078404487359329241164","43478981758376090947905583906143419560","105549899352138567472247528574255276468","321325204288527415351185891004280261569","147697608984753671911282489937155901288"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/00055febc3040d61788991d3d0bf4f0b8106df91"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-352518318.json"}}],"schema_version":"1.9.0"}