{"id":"ASB-A-416490321","details":"In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-416490321","CVE-2025-48607"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/03d7040699148c961df09dec301d8a1e982ee231"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"spl":"2025-12-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2c637955ab388773c234268ceb108372eaab2200","target":{"file":"core/java/android/app/AppOpsManager.java"},"deprecated":false,"digest":{"line_hashes":["276897995533553151856173741412933936226","263883961226356301595623142591329635561","236053623429280994372546549356335850078","86907914653025720359072416354381664774","313327869716555050030131011782412835775","266779834976702592228986342439662870125","284604982591840776653925392976721406264","295400564336163138098009546482765877088","168326625280130527874133286572641891435","283694341387728296423584995252718914627","111661843283796801641440801992309810692","99568029374753710372798575732837474030","21838045749582029720805560667835343211","12059556873219892432806907966399798737","216616085739766141235044241718371341407"],"threshold":0.9},"id":"ASB-A-416490321-09594a17","signature_type":"Line"},{"deprecated":false,"digest":{"length":485,"function_hash":"78334486128507158482994103539811495797"},"id":"ASB-A-416490321-2e5e52b8","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2c637955ab388773c234268ceb108372eaab2200","target":{"function":"getPackagesForOps","file":"core/java/android/app/AppOpsManager.java"}},{"id":"ASB-A-416490321-583e1833","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2c637955ab388773c234268ceb108372eaab2200","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["226232822886946447527178077525081945906","285687216582866042273411684981197205797","229466725191791125238583108919003793566","334407227210358995610428852715209744087","195873095192770407357522132084302058693","179674383965092675033340139858573546206","91300512756388223152278984262264295783","136466813743366407508487038657714607393","98182293265124673988837769921912408713","236509537353531872273707188062991204595","160804062386182573974681624592952490142","259288157474043206263228544162643810955","115647055362659947286755720992958479613","256395035412958004442114732854373905696","258918256806522354674352817732088176329","113617849721494071749342590041140837886","219150378069941443485159900474118195547","68618454673334817176100296773805061820","33695723627737050972833778006378378268","171105303850951652599136614468774359665"]}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2c637955ab388773c234268ceb108372eaab2200","target":{"file":"core/java/android/app/AppOpsManager.java","function":"getPackagesForOps"},"deprecated":false,"digest":{"function_hash":"93111154748997859951663410199732539260","length":192},"id":"ASB-A-416490321-61a73429"},{"digest":{"function_hash":"4491902149715576891550231049582172774","length":93},"id":"ASB-A-416490321-8fd61f09","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2c637955ab388773c234268ceb108372eaab2200","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"getPackagesForOps"},"deprecated":false},{"digest":{"length":935,"function_hash":"192436071487554944017278388249114425417"},"id":"ASB-A-416490321-c18a7474","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/2c637955ab388773c234268ceb108372eaab2200","target":{"function":"getPackagesForOpsForDevice","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/2c637955ab388773c234268ceb108372eaab2200"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416490321.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bd1eff349d514a53838df08ae097380d21c08c67","target":{"function":"getPackagesForOpsForDevice","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"function_hash":"192436071487554944017278388249114425417","length":935},"id":"ASB-A-416490321-092d05e0"},{"deprecated":false,"digest":{"line_hashes":["276897995533553151856173741412933936226","263883961226356301595623142591329635561","236053623429280994372546549356335850078","86907914653025720359072416354381664774","313327869716555050030131011782412835775","266779834976702592228986342439662870125","284604982591840776653925392976721406264","295400564336163138098009546482765877088","168326625280130527874133286572641891435","283694341387728296423584995252718914627","111661843283796801641440801992309810692","99568029374753710372798575732837474030","21838045749582029720805560667835343211","12059556873219892432806907966399798737","216616085739766141235044241718371341407"],"threshold":0.9},"id":"ASB-A-416490321-0dca7ead","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bd1eff349d514a53838df08ae097380d21c08c67","target":{"file":"core/java/android/app/AppOpsManager.java"}},{"digest":{"length":192,"function_hash":"93111154748997859951663410199732539260"},"id":"ASB-A-416490321-b99bc292","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bd1eff349d514a53838df08ae097380d21c08c67","target":{"file":"core/java/android/app/AppOpsManager.java","function":"getPackagesForOps"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"line_hashes":["226232822886946447527178077525081945906","285687216582866042273411684981197205797","229466725191791125238583108919003793566","334407227210358995610428852715209744087","266367977499092783760056923366870508962","283925731075049030647093880284423416387","89374406187834599121683175605148286692","86756713135538830368633563065622404564","236509537353531872273707188062991204595","160804062386182573974681624592952490142","259288157474043206263228544162643810955","115647055362659947286755720992958479613","256395035412958004442114732854373905696","258918256806522354674352817732088176329","113617849721494071749342590041140837886","219150378069941443485159900474118195547","68618454673334817176100296773805061820","33695723627737050972833778006378378268","171105303850951652599136614468774359665"],"threshold":0.9},"id":"ASB-A-416490321-d49ff0ee","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bd1eff349d514a53838df08ae097380d21c08c67"},{"target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"getPackagesForOps"},"deprecated":false,"digest":{"length":93,"function_hash":"4491902149715576891550231049582172774"},"id":"ASB-A-416490321-e6cd43a0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bd1eff349d514a53838df08ae097380d21c08c67"},{"digest":{"length":485,"function_hash":"78334486128507158482994103539811495797"},"id":"ASB-A-416490321-ec6cfc90","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bd1eff349d514a53838df08ae097380d21c08c67","target":{"file":"core/java/android/app/AppOpsManager.java","function":"getPackagesForOps"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bd1eff349d514a53838df08ae097380d21c08c67"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416490321.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["276897995533553151856173741412933936226","263883961226356301595623142591329635561","236053623429280994372546549356335850078","86907914653025720359072416354381664774","313327869716555050030131011782412835775","266779834976702592228986342439662870125","284604982591840776653925392976721406264","295400564336163138098009546482765877088","168326625280130527874133286572641891435","283694341387728296423584995252718914627","111661843283796801641440801992309810692","99568029374753710372798575732837474030","21838045749582029720805560667835343211","12059556873219892432806907966399798737","216616085739766141235044241718371341407"]},"id":"ASB-A-416490321-201339ee","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/aff2a8f38eb45e2c8f3321570e050c336a45b4bb","target":{"file":"core/java/android/app/AppOpsManager.java"}},{"deprecated":false,"digest":{"line_hashes":["226232822886946447527178077525081945906","285687216582866042273411684981197205797","229466725191791125238583108919003793566","334407227210358995610428852715209744087","266367977499092783760056923366870508962","283925731075049030647093880284423416387","321344061879275562792609391387676069597","98182293265124673988837769921912408713","236509537353531872273707188062991204595","160804062386182573974681624592952490142","259288157474043206263228544162643810955","115647055362659947286755720992958479613","256395035412958004442114732854373905696","258918256806522354674352817732088176329","113617849721494071749342590041140837886","219150378069941443485159900474118195547","68618454673334817176100296773805061820","33695723627737050972833778006378378268","171105303850951652599136614468774359665"],"threshold":0.9},"id":"ASB-A-416490321-34fc5736","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/aff2a8f38eb45e2c8f3321570e050c336a45b4bb","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"}},{"target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"getPackagesForOpsForDevice"},"deprecated":false,"digest":{"function_hash":"192436071487554944017278388249114425417","length":935},"id":"ASB-A-416490321-99a40b72","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/aff2a8f38eb45e2c8f3321570e050c336a45b4bb"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/aff2a8f38eb45e2c8f3321570e050c336a45b4bb","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"getPackagesForOps"},"deprecated":false,"digest":{"function_hash":"4491902149715576891550231049582172774","length":93},"id":"ASB-A-416490321-a34ed3ed","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/aff2a8f38eb45e2c8f3321570e050c336a45b4bb","target":{"file":"core/java/android/app/AppOpsManager.java","function":"getPackagesForOps"},"deprecated":false,"digest":{"function_hash":"93111154748997859951663410199732539260","length":192},"id":"ASB-A-416490321-ccef8233","signature_type":"Function","signature_version":"v1"},{"target":{"file":"core/java/android/app/AppOpsManager.java","function":"getPackagesForOps"},"deprecated":false,"digest":{"function_hash":"78334486128507158482994103539811495797","length":485},"id":"ASB-A-416490321-d15e1c7f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/aff2a8f38eb45e2c8f3321570e050c336a45b4bb"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/aff2a8f38eb45e2c8f3321570e050c336a45b4bb"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416490321.json"}}],"schema_version":"1.9.0"}