{"id":"ASB-A-411418366","details":"In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-411418366","CVE-2025-48541"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/apps/Settings/+/2aa27461a40b17462e57801d790545a7aeb897be"}],"affected":[{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/486947205e05e83314bd76e4822af442ca82be9c","target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java","function":"onCreate"},"deprecated":false,"digest":{"length":4495,"function_hash":"227229433164291859160370488113213868634"},"id":"ASB-A-411418366-4c700777","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["256996725924007623431941739141747334876","129168184458704929657029594075870807653","317052990326637223680216201171762677672","328815557156509061637359879486775838136","80542592904018868693702260099796770263","88768693263877192928537484360181103737","75142368034198355594493341289129831908","159480792993782115702915449279277805509","272698198914206317915000620065494305943","195187607796787106056124713950653808284","266062561033665142280478158087319262231","123522683292727238843354668382982649987","30321005233492427937322805395990089238"]},"id":"ASB-A-411418366-87f1986e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/486947205e05e83314bd76e4822af442ca82be9c","target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/486947205e05e83314bd76e4822af442ca82be9c"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-411418366.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["256996725924007623431941739141747334876","129168184458704929657029594075870807653","317052990326637223680216201171762677672","328815557156509061637359879486775838136","80542592904018868693702260099796770263","88768693263877192928537484360181103737","75142368034198355594493341289129831908","159480792993782115702915449279277805509","272698198914206317915000620065494305943","195187607796787106056124713950653808284","266062561033665142280478158087319262231","123522683292727238843354668382982649987","30321005233492427937322805395990089238"]},"id":"ASB-A-411418366-305d73c2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c60b1ebd9456aaf1e6d7168b0c75d1850767bffe","target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"44040525154800278352560449893897144671","length":3132},"id":"ASB-A-411418366-9218f02e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c60b1ebd9456aaf1e6d7168b0c75d1850767bffe","target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java","function":"onCreate"}}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c60b1ebd9456aaf1e6d7168b0c75d1850767bffe"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-411418366.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java"},"deprecated":false,"digest":{"line_hashes":["256996725924007623431941739141747334876","129168184458704929657029594075870807653","317052990326637223680216201171762677672","328815557156509061637359879486775838136","80542592904018868693702260099796770263","88768693263877192928537484360181103737","75142368034198355594493341289129831908","159480792993782115702915449279277805509","272698198914206317915000620065494305943","195187607796787106056124713950653808284","266062561033665142280478158087319262231","123522683292727238843354668382982649987","30321005233492427937322805395990089238"],"threshold":0.9},"id":"ASB-A-411418366-09346522","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/0baf462586f1bc99a120e005c5d273bd8cfa01e9"},{"digest":{"function_hash":"248417843224965968067379348294359699666","length":4381},"id":"ASB-A-411418366-34456362","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/0baf462586f1bc99a120e005c5d273bd8cfa01e9","target":{"function":"onCreate","file":"src/com/android/settings/biometrics/face/FaceSettings.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/0baf462586f1bc99a120e005c5d273bd8cfa01e9"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-411418366.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/c17853b926226715123d213f519180798df73287"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c17853b926226715123d213f519180798df73287","target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java","function":"onCreate"},"deprecated":false,"digest":{"function_hash":"134722857754326402630093452233398497652","length":2297},"id":"ASB-A-411418366-915bcdb0","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/apps/Settings/+/c17853b926226715123d213f519180798df73287","target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java"},"deprecated":false,"digest":{"line_hashes":["256996725924007623431941739141747334876","129168184458704929657029594075870807653","317052990326637223680216201171762677672","328815557156509061637359879486775838136","80542592904018868693702260099796770263","88768693263877192928537484360181103737","75142368034198355594493341289129831908","159480792993782115702915449279277805509","272698198914206317915000620065494305943","195187607796787106056124713950653808284","131385585299380238655650833726602009444","307174371279043274343352590246616269596","266632336048985912463887284626701081537"],"threshold":0.9},"id":"ASB-A-411418366-9ab20307","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-411418366.json"}},{"package":{"name":"platform/packages/apps/Settings","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/487c01bf13566c7a960259674ac2190f0e685ec3","target":{"file":"src/com/android/settings/biometrics/face/FaceSettings.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["256996725924007623431941739141747334876","129168184458704929657029594075870807653","317052990326637223680216201171762677672","328815557156509061637359879486775838136","80542592904018868693702260099796770263","88768693263877192928537484360181103737","75142368034198355594493341289129831908","159480792993782115702915449279277805509","272698198914206317915000620065494305943","195187607796787106056124713950653808284","131385585299380238655650833726602009444","307174371279043274343352590246616269596","266632336048985912463887284626701081537"]},"id":"ASB-A-411418366-68388108"},{"digest":{"function_hash":"134722857754326402630093452233398497652","length":2297},"id":"ASB-A-411418366-bd8a23be","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/apps/Settings/+/487c01bf13566c7a960259674ac2190f0e685ec3","target":{"function":"onCreate","file":"src/com/android/settings/biometrics/face/FaceSettings.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/apps/Settings/+/487c01bf13566c7a960259674ac2190f0e685ec3"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-411418366.json"}}],"schema_version":"1.9.0"}