{"id":"ASB-A-376462130","details":"In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-376462130","CVE-2025-48628"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/9489a5dcd3cdd426d5b39d9caf6bb78142af2399"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"17249994753077639583033949548719826913","length":409},"id":"ASB-A-376462130-0a38c95e","match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d40513846ee77a70f17e392ef9a9fc4ac254e44","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java","function":"getCustomPrinterIcon"}},{"deprecated":false,"digest":{"function_hash":"290683506610434064182548965051157555946","length":418},"id":"ASB-A-376462130-125a52bc","match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d40513846ee77a70f17e392ef9a9fc4ac254e44","target":{"function":"validateIconUserBoundary","file":"services/print/java/com/android/server/print/PrintManagerService.java"}},{"digest":{"threshold":0.9,"line_hashes":["292900562621289740165420360404681557470","254099383506272289078753119801457610562","8382420818903945909209296020667851894","129683185035301515800774035555900214112","144560406316237555514227971642960103123","121105015756870451983729303139400869049","12269312763036055637149775830685397506","51811925028379738733337479477147646550","49500282240160882735559372883360427948","319036711419564305351481126382329700162","22661505689850662044910177952232580203","145885833340027824153593893073583880482","117468171825901057644599160768166851910","62742841881505187972688201711196593492","74461250732356118188887879969476741519","137670604389648603397218284702580283826","208874961437982392320854375011095638438","9691820914408264737673435619125331401","248831598884452038878466996390314643165","339088883008861142350381993397367025083","165229237223858835770527078230508195854","43693651672511506419582617180681485734","108587633537507210242609878158511307392"]},"id":"ASB-A-376462130-54a73260","match_only_versions":["16-qpr2-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/8d40513846ee77a70f17e392ef9a9fc4ac254e44","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/8d40513846ee77a70f17e392ef9a9fc4ac254e44"],"severity":"High","spl":"2025-12-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-376462130.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java","function":"validateIconUserBoundary"},"deprecated":false,"digest":{"function_hash":"290683506610434064182548965051157555946","length":418},"id":"ASB-A-376462130-0e383348","match_only_versions":["15"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b42b179508127b2a762e1cee23cc7ad6ec4bb31f"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b42b179508127b2a762e1cee23cc7ad6ec4bb31f","target":{"function":"getCustomPrinterIcon","file":"services/print/java/com/android/server/print/PrintManagerService.java"},"deprecated":false,"digest":{"function_hash":"17249994753077639583033949548719826913","length":409},"id":"ASB-A-376462130-7de154b7","match_only_versions":["15"]},{"id":"ASB-A-376462130-a577f1b5","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b42b179508127b2a762e1cee23cc7ad6ec4bb31f","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["292900562621289740165420360404681557470","254099383506272289078753119801457610562","8382420818903945909209296020667851894","129683185035301515800774035555900214112","144560406316237555514227971642960103123","121105015756870451983729303139400869049","12269312763036055637149775830685397506","51811925028379738733337479477147646550","49500282240160882735559372883360427948","319036711419564305351481126382329700162","22661505689850662044910177952232580203","145885833340027824153593893073583880482","117468171825901057644599160768166851910","62742841881505187972688201711196593492","74461250732356118188887879969476741519","137670604389648603397218284702580283826","208874961437982392320854375011095638438","9691820914408264737673435619125331401","248831598884452038878466996390314643165","339088883008861142350381993397367025083","165229237223858835770527078230508195854","43693651672511506419582617180681485734","108587633537507210242609878158511307392"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b42b179508127b2a762e1cee23cc7ad6ec4bb31f"],"severity":"High","spl":"2025-12-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-376462130.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-376462130-02c71736","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9d76c20e720a567459156c06f858d5e27674706","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java","function":"validateIconUserBoundary"},"deprecated":false,"digest":{"length":418,"function_hash":"290683506610434064182548965051157555946"}},{"digest":{"function_hash":"17249994753077639583033949548719826913","length":409},"id":"ASB-A-376462130-3943e459","match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c9d76c20e720a567459156c06f858d5e27674706","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java","function":"getCustomPrinterIcon"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/c9d76c20e720a567459156c06f858d5e27674706","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java"},"deprecated":false,"digest":{"line_hashes":["292900562621289740165420360404681557470","254099383506272289078753119801457610562","8382420818903945909209296020667851894","129683185035301515800774035555900214112","144560406316237555514227971642960103123","121105015756870451983729303139400869049","12269312763036055637149775830685397506","51811925028379738733337479477147646550","49500282240160882735559372883360427948","319036711419564305351481126382329700162","22661505689850662044910177952232580203","145885833340027824153593893073583880482","117468171825901057644599160768166851910","62742841881505187972688201711196593492","74461250732356118188887879969476741519","137670604389648603397218284702580283826","208874961437982392320854375011095638438","9691820914408264737673435619125331401","248831598884452038878466996390314643165","339088883008861142350381993397367025083","165229237223858835770527078230508195854","43693651672511506419582617180681485734","108587633537507210242609878158511307392"],"threshold":0.9},"id":"ASB-A-376462130-c766847e","match_only_versions":["16"],"signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c9d76c20e720a567459156c06f858d5e27674706"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-376462130.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"id":"ASB-A-376462130-16de701b","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/572633308c9d114387ae88127a38888c2e6d2bd3","target":{"function":"validateIconUserBoundary","file":"services/print/java/com/android/server/print/PrintManagerService.java"},"deprecated":false,"digest":{"function_hash":"290683506610434064182548965051157555946","length":418}},{"deprecated":false,"digest":{"function_hash":"17249994753077639583033949548719826913","length":409},"id":"ASB-A-376462130-685e61a7","match_only_versions":["13"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/572633308c9d114387ae88127a38888c2e6d2bd3","target":{"function":"getCustomPrinterIcon","file":"services/print/java/com/android/server/print/PrintManagerService.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["292900562621289740165420360404681557470","254099383506272289078753119801457610562","8382420818903945909209296020667851894","129683185035301515800774035555900214112","144560406316237555514227971642960103123","121105015756870451983729303139400869049","12269312763036055637149775830685397506","51811925028379738733337479477147646550","49500282240160882735559372883360427948","319036711419564305351481126382329700162","22661505689850662044910177952232580203","145885833340027824153593893073583880482","117468171825901057644599160768166851910","62742841881505187972688201711196593492","74461250732356118188887879969476741519","137670604389648603397218284702580283826","208874961437982392320854375011095638438","9691820914408264737673435619125331401","248831598884452038878466996390314643165","339088883008861142350381993397367025083","165229237223858835770527078230508195854","43693651672511506419582617180681485734","108587633537507210242609878158511307392"]},"id":"ASB-A-376462130-e55d7535","match_only_versions":["13"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/572633308c9d114387ae88127a38888c2e6d2bd3","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java"}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/572633308c9d114387ae88127a38888c2e6d2bd3"],"severity":"High","spl":"2025-12-01","types":["ID"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-376462130.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-12-01","types":["ID"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6bc3fb05b7ad52345356536a1c6a1d6c3d9f4358","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java"},"deprecated":false,"digest":{"line_hashes":["292900562621289740165420360404681557470","254099383506272289078753119801457610562","8382420818903945909209296020667851894","129683185035301515800774035555900214112","144560406316237555514227971642960103123","121105015756870451983729303139400869049","12269312763036055637149775830685397506","51811925028379738733337479477147646550","49500282240160882735559372883360427948","319036711419564305351481126382329700162","22661505689850662044910177952232580203","145885833340027824153593893073583880482","117468171825901057644599160768166851910","62742841881505187972688201711196593492","74461250732356118188887879969476741519","137670604389648603397218284702580283826","208874961437982392320854375011095638438","9691820914408264737673435619125331401","248831598884452038878466996390314643165","339088883008861142350381993397367025083","165229237223858835770527078230508195854","43693651672511506419582617180681485734","108587633537507210242609878158511307392"],"threshold":0.9},"id":"ASB-A-376462130-1d8b81ac","match_only_versions":["14"],"signature_type":"Line"},{"id":"ASB-A-376462130-3fa35c98","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6bc3fb05b7ad52345356536a1c6a1d6c3d9f4358","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java","function":"validateIconUserBoundary"},"deprecated":false,"digest":{"length":418,"function_hash":"290683506610434064182548965051157555946"}},{"digest":{"function_hash":"17249994753077639583033949548719826913","length":409},"id":"ASB-A-376462130-89748572","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6bc3fb05b7ad52345356536a1c6a1d6c3d9f4358","target":{"file":"services/print/java/com/android/server/print/PrintManagerService.java","function":"getCustomPrinterIcon"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6bc3fb05b7ad52345356536a1c6a1d6c3d9f4358"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-376462130.json"}}],"schema_version":"1.9.0"}