{"id":"ASB-A-414388731","details":"In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-414388731","CVE-2025-48609"],"modified":"2026-04-15T15:55:00.724021Z","published":"2026-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/37babc702849821595634b6ecfda6f04404e2cf1"}],"affected":[{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-03-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"length":118,"function_hash":"185383777060186089060963810076651023882"},"id":"ASB-A-414388731-3bbbfce4","target":{"function":"deleteTempDrmData","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":2169,"function_hash":"332830692506409322550008588395527232446"},"id":"ASB-A-414388731-3d77cedb","target":{"function":"delete","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":119,"function_hash":"186155285475000175273911461990874809334"},"id":"ASB-A-414388731-63b30b8d","target":{"function":"deleteParts","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":784,"function_hash":"329089477581720904298340554807929798723"},"id":"ASB-A-414388731-6cfdcf7b","target":{"function":"deleteMessages","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["193487512413296944842018133587307488137","54426199685994587205111517778621039575","49098373247327089245058110436302407840","290077859806459022622000364631666257263","179975397300930122791953571682316672237","136354278098566458989389638801460446552","23734789791809211594017926234763733044","192834911806763947942617732445137554297","138440219730600968351015465466017844812","82530675571816980675600370952265172158","48654976868784941091245281308533874843","234454237950777862195763692517438831766","15227220659542872464036330171661899207","229736580394123014844795682416237373489","149720950312962312114042436942979066627","248613936088551488095154671533061382273","194603021219017133187034267791794425939","167047802080481713518629236628977275995","286368758236405211738596911259960538574","198815440307191692615147971604678857776","246925996441339914974587727781601570966","146419165976207140346156343087225330859","88303617534232479086015295935738931302","7964578774576367623307982784696615500","123119038000153802413535994209939483809","80974978909209042393482395583791228678","194858390801495658156234039662443122915","227709635174461743862290081929706700253","127095347795933499691840683928355893723","175891805189599234879348700277257150137","187030331269791015354517928519949151707","323107468969507177190264065581279484463","322550267590776292868444003540675648249","261688335834709763401340237117573543931","250467120481558609086138584308421068555","48769901216742361438309844763804182838","256901942582268600472965081590324284852","198284140933499583857874397991242086395","23327263627028713720035528027687567358","302448485869448538110622370159691592174","181285631823673084957542630280588184734","2457838324696781268442526060530259437","237307855459335826907545414011834762829","119691375564133107529287564354821979552","291412556644149925503484450477243160454","194586130108907207993467344580784298061","289664244399351921955153102034488219899","263169593417655278521978245580617962211","216955298845499529876756994536074233735"],"threshold":0.9},"id":"ASB-A-414388731-90c74b84","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":1154,"function_hash":"321899206303071841065183788340070035630"},"id":"ASB-A-414388731-ae14e558","target":{"function":"safeOpenFileHelper","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":565,"function_hash":"322735919789435188783386420414998236049"},"id":"ASB-A-414388731-f3712a9d","target":{"function":"deleteDataRows","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208","signature_type":"Function","deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/fce8998a1770d05a768c30e5822c25db1b758208"],"spl":"2026-03-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-414388731.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-03-01"}]}],"versions":["15"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"length":565,"function_hash":"322735919789435188783386420414998236049"},"id":"ASB-A-414388731-012267a0","target":{"function":"deleteDataRows","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":2169,"function_hash":"332830692506409322550008588395527232446"},"id":"ASB-A-414388731-557cce4c","target":{"function":"delete","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":1154,"function_hash":"321899206303071841065183788340070035630"},"id":"ASB-A-414388731-6b9e8a2d","target":{"function":"safeOpenFileHelper","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["270029044991422831069439618907891094660","193487512413296944842018133587307488137","54426199685994587205111517778621039575","23734789791809211594017926234763733044","192834911806763947942617732445137554297","138440219730600968351015465466017844812","82530675571816980675600370952265172158","48654976868784941091245281308533874843","234454237950777862195763692517438831766","15227220659542872464036330171661899207","229736580394123014844795682416237373489","149720950312962312114042436942979066627","248613936088551488095154671533061382273","194603021219017133187034267791794425939","167047802080481713518629236628977275995","286368758236405211738596911259960538574","198815440307191692615147971604678857776","246925996441339914974587727781601570966","146419165976207140346156343087225330859","88303617534232479086015295935738931302","7964578774576367623307982784696615500","123119038000153802413535994209939483809","80974978909209042393482395583791228678","194858390801495658156234039662443122915","227709635174461743862290081929706700253","127095347795933499691840683928355893723","175891805189599234879348700277257150137","187030331269791015354517928519949151707","323107468969507177190264065581279484463","322550267590776292868444003540675648249","261688335834709763401340237117573543931","250467120481558609086138584308421068555","48769901216742361438309844763804182838","256901942582268600472965081590324284852","198284140933499583857874397991242086395","23327263627028713720035528027687567358","302448485869448538110622370159691592174","181285631823673084957542630280588184734","2457838324696781268442526060530259437","237307855459335826907545414011834762829","119691375564133107529287564354821979552","291412556644149925503484450477243160454","194586130108907207993467344580784298061","289664244399351921955153102034488219899","263169593417655278521978245580617962211","216955298845499529876756994536074233735"],"threshold":0.9},"id":"ASB-A-414388731-70bc20e5","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":119,"function_hash":"186155285475000175273911461990874809334"},"id":"ASB-A-414388731-c0099829","target":{"function":"deleteParts","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":118,"function_hash":"185383777060186089060963810076651023882"},"id":"ASB-A-414388731-c720e92e","target":{"function":"deleteTempDrmData","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":784,"function_hash":"329089477581720904298340554807929798723"},"id":"ASB-A-414388731-dead7f8a","target":{"function":"deleteMessages","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2","signature_type":"Function","deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/0674b3c1fc57efa05595e4302ef12e9580bf8dd2"],"spl":"2026-03-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-414388731.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-03-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"line_hashes":["270029044991422831069439618907891094660","193487512413296944842018133587307488137","54426199685994587205111517778621039575","23734789791809211594017926234763733044","192834911806763947942617732445137554297","138440219730600968351015465466017844812","82530675571816980675600370952265172158","48654976868784941091245281308533874843","234454237950777862195763692517438831766","15227220659542872464036330171661899207","229736580394123014844795682416237373489","149720950312962312114042436942979066627","248613936088551488095154671533061382273","194603021219017133187034267791794425939","167047802080481713518629236628977275995","286368758236405211738596911259960538574","198815440307191692615147971604678857776","246925996441339914974587727781601570966","146419165976207140346156343087225330859","88303617534232479086015295935738931302","7964578774576367623307982784696615500","123119038000153802413535994209939483809","80974978909209042393482395583791228678","194858390801495658156234039662443122915","227709635174461743862290081929706700253","127095347795933499691840683928355893723","175891805189599234879348700277257150137","187030331269791015354517928519949151707","323107468969507177190264065581279484463","322550267590776292868444003540675648249","261688335834709763401340237117573543931","250467120481558609086138584308421068555","48769901216742361438309844763804182838","256901942582268600472965081590324284852","198284140933499583857874397991242086395","23327263627028713720035528027687567358","302448485869448538110622370159691592174","181285631823673084957542630280588184734","2457838324696781268442526060530259437","237307855459335826907545414011834762829","119691375564133107529287564354821979552","291412556644149925503484450477243160454","194586130108907207993467344580784298061","289664244399351921955153102034488219899","263169593417655278521978245580617962211","216955298845499529876756994536074233735"],"threshold":0.9},"id":"ASB-A-414388731-18efc24b","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff","signature_type":"Line","deprecated":false},{"signature_version":"v1","digest":{"length":118,"function_hash":"185383777060186089060963810076651023882"},"id":"ASB-A-414388731-5f610b81","target":{"function":"deleteTempDrmData","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":119,"function_hash":"186155285475000175273911461990874809334"},"id":"ASB-A-414388731-650e1d1f","target":{"function":"deleteParts","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":565,"function_hash":"322735919789435188783386420414998236049"},"id":"ASB-A-414388731-c1bb4866","target":{"function":"deleteDataRows","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":1154,"function_hash":"321899206303071841065183788340070035630"},"id":"ASB-A-414388731-cd8ebe56","target":{"function":"safeOpenFileHelper","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":784,"function_hash":"329089477581720904298340554807929798723"},"id":"ASB-A-414388731-d4b83377","target":{"function":"deleteMessages","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":2169,"function_hash":"332830692506409322550008588395527232446"},"id":"ASB-A-414388731-eb61b72c","target":{"function":"delete","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff","signature_type":"Function","deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/9ce5c9d9bd63c7db1ba5ff3e3e834e03b00d0fff"],"spl":"2026-03-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-414388731.json"}},{"package":{"name":"platform/packages/providers/TelephonyProvider","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-03-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","vanir_signatures":[{"signature_version":"v1","digest":{"length":1983,"function_hash":"312145806247619775038913395180287754851"},"id":"ASB-A-414388731-143d5e45","target":{"function":"delete","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":565,"function_hash":"322735919789435188783386420414998236049"},"id":"ASB-A-414388731-199ec695","target":{"function":"deleteDataRows","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":118,"function_hash":"185383777060186089060963810076651023882"},"id":"ASB-A-414388731-1cc154c2","target":{"function":"deleteTempDrmData","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":119,"function_hash":"186155285475000175273911461990874809334"},"id":"ASB-A-414388731-4f756a25","target":{"function":"deleteParts","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":784,"function_hash":"329089477581720904298340554807929798723"},"id":"ASB-A-414388731-a3bea738","target":{"function":"deleteMessages","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"length":1154,"function_hash":"321899206303071841065183788340070035630"},"id":"ASB-A-414388731-a96d0763","target":{"function":"safeOpenFileHelper","file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601","signature_type":"Function","deprecated":false},{"signature_version":"v1","digest":{"line_hashes":["44981187549435029979966728615808973152","23734789791809211594017926234763733044","192834911806763947942617732445137554297","138440219730600968351015465466017844812","82530675571816980675600370952265172158","48654976868784941091245281308533874843","234454237950777862195763692517438831766","15227220659542872464036330171661899207","229736580394123014844795682416237373489","149720950312962312114042436942979066627","248613936088551488095154671533061382273","194603021219017133187034267791794425939","167047802080481713518629236628977275995","286368758236405211738596911259960538574","198815440307191692615147971604678857776","246925996441339914974587727781601570966","146419165976207140346156343087225330859","88303617534232479086015295935738931302","7964578774576367623307982784696615500","123119038000153802413535994209939483809","80974978909209042393482395583791228678","194858390801495658156234039662443122915","227709635174461743862290081929706700253","127095347795933499691840683928355893723","175891805189599234879348700277257150137","187030331269791015354517928519949151707","323107468969507177190264065581279484463","322550267590776292868444003540675648249","261688335834709763401340237117573543931","250467120481558609086138584308421068555","48769901216742361438309844763804182838","256901942582268600472965081590324284852","198284140933499583857874397991242086395","23327263627028713720035528027687567358","302448485869448538110622370159691592174","181285631823673084957542630280588184734","2457838324696781268442526060530259437","237307855459335826907545414011834762829","119691375564133107529287564354821979552","291412556644149925503484450477243160454","194586130108907207993467344580784298061","289664244399351921955153102034488219899","263169593417655278521978245580617962211","216955298845499529876756994536074233735"],"threshold":0.9},"id":"ASB-A-414388731-c19d23fa","target":{"file":"src/com/android/providers/telephony/MmsProvider.java"},"source":"https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601","signature_type":"Line","deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/727d4c29acc11f5459cf0e587044e5115184b601"],"spl":"2026-03-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-414388731.json"}}],"schema_version":"1.7.5"}