{"id":"ASB-A-381419370","details":"In getDefaultCBRPackageName of CellBroadcastHandler.java, there is a possible escalation of privilege due to a logic error in the code. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-381419370","CVE-2025-48534"],"modified":"2026-04-17T15:55:28.020024Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/584cec4f17eab96ac44bce4e1bce8d6a2c59cd75"}],"affected":[{"package":{"name":"platform/packages/modules/CellBroadcastService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/f24f40e2512f450b6a23536a4209318cd3043d99"],"vanir_signatures":[{"id":"ASB-A-381419370-cadbbd3d","digest":{"threshold":0.9,"line_hashes":["229383887102601680922852790833754304230","141810931579789339750446748710326395497","80542602676654137643192830151413156649","42118811782239853336648357384524957807","49220023255004370396720794536412495399","269536328584148118684236832218678176375"]},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/f24f40e2512f450b6a23536a4209318cd3043d99","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java"},"signature_type":"Line","deprecated":false,"signature_version":"v1"},{"id":"ASB-A-381419370-efa668bd","digest":{"length":895,"function_hash":"333886007212517124554015647330486935103"},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/f24f40e2512f450b6a23536a4209318cd3043d99","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java","function":"getDefaultCBRPackageName"},"signature_type":"Function","deprecated":false,"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-381419370.json"}},{"package":{"name":"platform/packages/modules/CellBroadcastService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-09-01","severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/58425e1352ecfaf3ee4e862622127a24fbe1cc38"],"vanir_signatures":[{"id":"ASB-A-381419370-17d60347","digest":{"length":895,"function_hash":"333886007212517124554015647330486935103"},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/58425e1352ecfaf3ee4e862622127a24fbe1cc38","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java","function":"getDefaultCBRPackageName"},"signature_type":"Function","deprecated":false,"signature_version":"v1"},{"id":"ASB-A-381419370-7b0495b0","digest":{"threshold":0.9,"line_hashes":["229383887102601680922852790833754304230","141810931579789339750446748710326395497","80542602676654137643192830151413156649","42118811782239853336648357384524957807","49220023255004370396720794536412495399","269536328584148118684236832218678176375"]},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/58425e1352ecfaf3ee4e862622127a24fbe1cc38","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java"},"signature_type":"Line","deprecated":false,"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-381419370.json"}},{"package":{"name":"platform/packages/modules/CellBroadcastService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-09-01","severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/39502c8f5819e13065065eda2e6f210198343dae"],"vanir_signatures":[{"id":"ASB-A-381419370-74264314","digest":{"threshold":0.9,"line_hashes":["229383887102601680922852790833754304230","141810931579789339750446748710326395497","80542602676654137643192830151413156649","42118811782239853336648357384524957807","49220023255004370396720794536412495399","269536328584148118684236832218678176375"]},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/39502c8f5819e13065065eda2e6f210198343dae","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java"},"signature_type":"Line","deprecated":false,"signature_version":"v1"},{"id":"ASB-A-381419370-ac59d08e","digest":{"length":687,"function_hash":"197366163784096692888996499679791529220"},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/39502c8f5819e13065065eda2e6f210198343dae","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java","function":"getDefaultCBRPackageName"},"signature_type":"Function","deprecated":false,"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-381419370.json"}},{"package":{"name":"platform/packages/modules/CellBroadcastService","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2025-09-01","severity":"High","types":["DoS"],"fixes":["https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/ce0677bd93fc50b895124af90e238614250445c7"],"vanir_signatures":[{"id":"ASB-A-381419370-2f09f757","digest":{"threshold":0.9,"line_hashes":["229383887102601680922852790833754304230","141810931579789339750446748710326395497","80542602676654137643192830151413156649","42118811782239853336648357384524957807","49220023255004370396720794536412495399","269536328584148118684236832218678176375"]},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/ce0677bd93fc50b895124af90e238614250445c7","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java"},"signature_type":"Line","deprecated":false,"signature_version":"v1"},{"id":"ASB-A-381419370-eacc6175","digest":{"length":895,"function_hash":"333886007212517124554015647330486935103"},"source":"https://android.googlesource.com/platform/packages/modules/CellBroadcastService/+/ce0677bd93fc50b895124af90e238614250445c7","target":{"file":"src/com/android/cellbroadcastservice/CellBroadcastHandler.java","function":"getDefaultCBRPackageName"},"signature_type":"Function","deprecated":false,"signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-381419370.json"}}],"schema_version":"1.7.5"}