{"id":"ASB-A-392699284","details":"In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-392699284","CVE-2025-48641"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/hardware/st/nfc/+/c6da9eeb710c6690d189cb2d1b80b44755860b55"}],"affected":[{"package":{"name":"platform/hardware/st/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["79796661121573200220071744186753808563","260676127609979959147088514220091680245","4744720766236171762223566416631281136","42304224396174553837754489067332586913","9343727692609402455908070722508534348","230749089815527001769992850225045251020","155605154296272474772440429335550660540","329304408206514442431867128541929060943","73890880300246223251455988817715098332","66487333191656139465205971458159557855","61010415226422664149445310127818561685","29714651309249216046414313261437647815","211893118048992337490058969478773962607","46769676938508527565289698180796837430","11295222368027826195083741734620076701","264372954472183302800051110910507753281","68111199641441598955153103211415680898","97208042744731146783035866392819633054"]},"id":"ASB-A-392699284-06a18809","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/st/nfc/+/fc619c3348188ff0020cdeb7d4c4728a0246fe1a","target":{"file":"aidl/Nfc.h"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/hardware/st/nfc/+/fc619c3348188ff0020cdeb7d4c4728a0246fe1a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-392699284.json"}},{"package":{"name":"platform/hardware/st/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"aidl/Nfc.h"},"deprecated":false,"digest":{"line_hashes":["79796661121573200220071744186753808563","260676127609979959147088514220091680245","4744720766236171762223566416631281136","82587891364957260158538153064737268168","49371139033785992900520374946111813212","230749089815527001769992850225045251020","155605154296272474772440429335550660540","329304408206514442431867128541929060943","73890880300246223251455988817715098332","66487333191656139465205971458159557855","61010415226422664149445310127818561685","29714651309249216046414313261437647815","211893118048992337490058969478773962607","46769676938508527565289698180796837430","11295222368027826195083741734620076701","264372954472183302800051110910507753281","68111199641441598955153103211415680898","97208042744731146783035866392819633054"],"threshold":0.9},"id":"ASB-A-392699284-7989541f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/st/nfc/+/8473fbf70ec5b09eec8e05d3ade55358d1d02b12"}],"fixes":["https://android.googlesource.com/platform/hardware/st/nfc/+/8473fbf70ec5b09eec8e05d3ade55358d1d02b12"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-392699284.json"}},{"package":{"name":"platform/hardware/st/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/st/nfc/+/33b3c128e0f480f6e421761b85c5f00289b62449","target":{"file":"aidl/Nfc.h"},"deprecated":false,"digest":{"line_hashes":["79796661121573200220071744186753808563","260676127609979959147088514220091680245","4744720766236171762223566416631281136","42304224396174553837754489067332586913","9343727692609402455908070722508534348","230749089815527001769992850225045251020","155605154296272474772440429335550660540","329304408206514442431867128541929060943","73890880300246223251455988817715098332","66487333191656139465205971458159557855","61010415226422664149445310127818561685","29714651309249216046414313261437647815","211893118048992337490058969478773962607","46769676938508527565289698180796837430","11295222368027826195083741734620076701","264372954472183302800051110910507753281","68111199641441598955153103211415680898","97208042744731146783035866392819633054"],"threshold":0.9},"id":"ASB-A-392699284-ca5429e6"}],"fixes":["https://android.googlesource.com/platform/hardware/st/nfc/+/33b3c128e0f480f6e421761b85c5f00289b62449"],"severity":"High","spl":"2026-03-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-392699284.json"}},{"package":{"name":"platform/hardware/st/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-03-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/hardware/st/nfc/+/446428a1e9c89be2074dcedb745c1b8f39b23235"],"severity":"High","spl":"2026-03-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/hardware/st/nfc/+/446428a1e9c89be2074dcedb745c1b8f39b23235","target":{"file":"aidl/Nfc.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["79796661121573200220071744186753808563","260676127609979959147088514220091680245","4744720766236171762223566416631281136","42304224396174553837754489067332586913","9343727692609402455908070722508534348","230749089815527001769992850225045251020","155605154296272474772440429335550660540","329304408206514442431867128541929060943","73890880300246223251455988817715098332","66487333191656139465205971458159557855","61010415226422664149445310127818561685","29714651309249216046414313261437647815","211893118048992337490058969478773962607","46769676938508527565289698180796837430","11295222368027826195083741734620076701","264372954472183302800051110910507753281","68111199641441598955153103211415680898","97208042744731146783035866392819633054"]},"id":"ASB-A-392699284-944cd6ee","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-392699284.json"}},{"package":{"name":"platform/hardware/st/nfc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"aidl/Nfc.h"},"deprecated":false,"digest":{"line_hashes":["79796661121573200220071744186753808563","260676127609979959147088514220091680245","4744720766236171762223566416631281136","82587891364957260158538153064737268168","49371139033785992900520374946111813212","230749089815527001769992850225045251020","155605154296272474772440429335550660540","329304408206514442431867128541929060943","73890880300246223251455988817715098332","66487333191656139465205971458159557855","61010415226422664149445310127818561685","29714651309249216046414313261437647815","211893118048992337490058969478773962607","46769676938508527565289698180796837430","11295222368027826195083741734620076701","264372954472183302800051110910507753281","68111199641441598955153103211415680898","97208042744731146783035866392819633054"],"threshold":0.9},"id":"ASB-A-392699284-3bc8ab03","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/hardware/st/nfc/+/07468d68ad37d8a7a430eb6433d6ca0e9ed9c589"}],"fixes":["https://android.googlesource.com/platform/hardware/st/nfc/+/07468d68ad37d8a7a430eb6433d6ca0e9ed9c589"],"severity":"High","spl":"2026-03-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-392699284.json"}}],"schema_version":"1.9.0"}