{"id":"ASB-A-416491779","details":"In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-416491779","CVE-2025-48559"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/f745b6763bffabb0d28e17efbcef5b1d261b5814"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"334704927292896546458282507381958379927","length":1178},"id":"ASB-A-416491779-0a5deb8c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"finishOperationUnchecked"},"deprecated":false},{"source":"https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"verifyAndGetBypass"},"deprecated":false,"digest":{"function_hash":"111967766583563337480242246371989750843","length":3405},"id":"ASB-A-416491779-545f70fb","signature_type":"Function","signature_version":"v1"},{"target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"finishProxyOperationImpl"},"deprecated":false,"digest":{"function_hash":"327351317148874351051936886024995642625","length":1055},"id":"ASB-A-416491779-c5ffc71e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334"},{"digest":{"line_hashes":["145533244394736777395731452236992008948","182579222671641036008456792982496461036","107591864359346254554150275515285606047","248772084889652525055504487801912826691","85681592519442832056565856915305771783","10741109392020906302907331903711148440","309900105482878652350026734096691180069","298003043970286345154228361254524237621","128046658418123467001747816450010594390","79745726213375083831113428051279685537","141827826080887564643400668847525488327","266080197234080450483255357434435658099","96473944444397072355208669320627881184","308632757527921590426640414761795115068","286423069938739402049272415851038774081","201093797458725854064338772421567490248","124054076399324471630608617786007720709","286085259704673804422033465527098940917","165450472562439424311051595638473434928","237422163748034095650877695024740199813","126896969738788003213948840285398483375","326671246052218534208019850571232824079","198385719537384758387429535128527416772","315952819557544547305654039091072256369","103285690949153253017694988257707593738","255582232247872434010096351322051971832","245750786413319727894170518589327460774","110484453700089275035591506105064992793","161108383840385617822320201804815905892","14647373960907151971344084714157858522","262754680900253367976251405950549203304","198872632702529793301821859466264200115","217525580373318332542580908768624589425","116256911430510318547601549537866915458","51155141883239242627593694561320896375","334256952925092768415641147313273253070","327146297051040508688237695062253274717","229881087295695753805407895940465887942","308030141275839695269238968837200168390","117987537531020790817837648613375359968","31197032750000031620870360164106773875","106668003845575818094709242710479608026","147388735585732077698752243275182760238","228085740630932503487399084921443665430","305746464712692291170662939816387014396","132340738130790428793573747325850266128","257196362004999581498472046323076186034","99258469862926988714611812929941645580","20202893608044096791124949774349315572","165229511530923198138663292093310549636","223348011294678245660878046408810816469","324900586039617778497669082062963388034","63187830824006094765050704652296615372"],"threshold":0.9},"id":"ASB-A-416491779-eec3edcd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ab99cde450cf900767a641ddcf71f4a42e771334"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416491779.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"line_hashes":["145533244394736777395731452236992008948","182579222671641036008456792982496461036","107591864359346254554150275515285606047","248772084889652525055504487801912826691","85681592519442832056565856915305771783","10741109392020906302907331903711148440","309900105482878652350026734096691180069","298003043970286345154228361254524237621","128046658418123467001747816450010594390","79745726213375083831113428051279685537","141827826080887564643400668847525488327","266080197234080450483255357434435658099","96473944444397072355208669320627881184","308632757527921590426640414761795115068","286423069938739402049272415851038774081","201093797458725854064338772421567490248","124054076399324471630608617786007720709","286085259704673804422033465527098940917","165450472562439424311051595638473434928","237422163748034095650877695024740199813","126896969738788003213948840285398483375","326671246052218534208019850571232824079","198385719537384758387429535128527416772","315952819557544547305654039091072256369","119021153742612316687371175755315154247","255582232247872434010096351322051971832","245750786413319727894170518589327460774","110484453700089275035591506105064992793","161108383840385617822320201804815905892","14647373960907151971344084714157858522","262754680900253367976251405950549203304","198872632702529793301821859466264200115","217525580373318332542580908768624589425","116256911430510318547601549537866915458","51155141883239242627593694561320896375","334256952925092768415641147313273253070","327146297051040508688237695062253274717","229881087295695753805407895940465887942","308030141275839695269238968837200168390","117987537531020790817837648613375359968","31197032750000031620870360164106773875","106668003845575818094709242710479608026","147388735585732077698752243275182760238","228085740630932503487399084921443665430","305746464712692291170662939816387014396","132340738130790428793573747325850266128","257196362004999581498472046323076186034","99258469862926988714611812929941645580","20202893608044096791124949774349315572","165229511530923198138663292093310549636","223348011294678245660878046408810816469","324900586039617778497669082062963388034","63187830824006094765050704652296615372"],"threshold":0.9},"id":"ASB-A-416491779-456e5737","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35","target":{"function":"finishOperationUnchecked","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"function_hash":"142377889538189004401053715356650317274","length":1170},"id":"ASB-A-416491779-78fef3ec"},{"deprecated":false,"digest":{"function_hash":"327351317148874351051936886024995642625","length":1055},"id":"ASB-A-416491779-d157c220","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"finishProxyOperationImpl"}},{"id":"ASB-A-416491779-f9c2a717","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35","target":{"function":"verifyAndGetBypass","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"function_hash":"111967766583563337480242246371989750843","length":3405}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/03012467103fb5eb0e375173934a35c1a053ff35"],"severity":"High","spl":"2025-09-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416491779.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["DoS"],"vanir_signatures":[{"digest":{"function_hash":"111967766583563337480242246371989750843","length":3405},"id":"ASB-A-416491779-41f7b3a0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8","target":{"function":"verifyAndGetBypass","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false},{"digest":{"line_hashes":["145533244394736777395731452236992008948","182579222671641036008456792982496461036","107591864359346254554150275515285606047","248772084889652525055504487801912826691","85681592519442832056565856915305771783","10741109392020906302907331903711148440","309900105482878652350026734096691180069","298003043970286345154228361254524237621","128046658418123467001747816450010594390","79745726213375083831113428051279685537","141827826080887564643400668847525488327","266080197234080450483255357434435658099","96473944444397072355208669320627881184","308632757527921590426640414761795115068","286423069938739402049272415851038774081","201093797458725854064338772421567490248","124054076399324471630608617786007720709","286085259704673804422033465527098940917","165450472562439424311051595638473434928","237422163748034095650877695024740199813","126896969738788003213948840285398483375","326671246052218534208019850571232824079","198385719537384758387429535128527416772","315952819557544547305654039091072256369","103285690949153253017694988257707593738","255582232247872434010096351322051971832","245750786413319727894170518589327460774","110484453700089275035591506105064992793","161108383840385617822320201804815905892","14647373960907151971344084714157858522","262754680900253367976251405950549203304","198872632702529793301821859466264200115","217525580373318332542580908768624589425","116256911430510318547601549537866915458","51155141883239242627593694561320896375","334256952925092768415641147313273253070","327146297051040508688237695062253274717","229881087295695753805407895940465887942","308030141275839695269238968837200168390","117987537531020790817837648613375359968","31197032750000031620870360164106773875","106668003845575818094709242710479608026","147388735585732077698752243275182760238","228085740630932503487399084921443665430","305746464712692291170662939816387014396","132340738130790428793573747325850266128","257196362004999581498472046323076186034","99258469862926988714611812929941645580","20202893608044096791124949774349315572","165229511530923198138663292093310549636","223348011294678245660878046408810816469","324900586039617778497669082062963388034","63187830824006094765050704652296615372"],"threshold":0.9},"id":"ASB-A-416491779-9631a57e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"finishOperationUnchecked"},"deprecated":false,"digest":{"function_hash":"334704927292896546458282507381958379927","length":1178},"id":"ASB-A-416491779-ac6e8904"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8","target":{"function":"finishProxyOperationImpl","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"function_hash":"327351317148874351051936886024995642625","length":1055},"id":"ASB-A-416491779-b1b8f5e9","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/f38b9f07a1aa39a1a7cf67fc27719e190b421be8"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416491779.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854"],"severity":"High","spl":"2025-09-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"verifyAndGetBypass"},"deprecated":false,"digest":{"length":3397,"function_hash":"47731183929077967472043063613341641217"},"id":"ASB-A-416491779-1cc04b6f","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"line_hashes":["145533244394736777395731452236992008948","309215926538045402602657564343502449411","212736499001916873285724335412318095409","140468702664407564615741072009711414593","111894624664285355382775798437093391310","36832147086446174073806500118908194327","67259588965742049087858546075940583252","213300930277564897353494739351679481071","176107377025305689034526358438740090604","79745726213375083831113428051279685537","141827826080887564643400668847525488327","266080197234080450483255357434435658099","286085259704673804422033465527098940917","165450472562439424311051595638473434928","237422163748034095650877695024740199813","126896969738788003213948840285398483375","326671246052218534208019850571232824079","198385719537384758387429535128527416772","315952819557544547305654039091072256369","335334773055924698587996816271197000479","142755240643133366352348226964143927718","122544624308948724187252201795294179415","1577266320319389897667113252356691913","245750786413319727894170518589327460774","110484453700089275035591506105064992793","161108383840385617822320201804815905892","14647373960907151971344084714157858522","262754680900253367976251405950549203304","198872632702529793301821859466264200115","217525580373318332542580908768624589425","116256911430510318547601549537866915458","51155141883239242627593694561320896375","334256952925092768415641147313273253070","327146297051040508688237695062253274717","229881087295695753805407895940465887942","308030141275839695269238968837200168390","117987537531020790817837648613375359968","31197032750000031620870360164106773875","106668003845575818094709242710479608026","147388735585732077698752243275182760238","228085740630932503487399084921443665430","305746464712692291170662939816387014396","132340738130790428793573747325850266128","257196362004999581498472046323076186034","99258469862926988714611812929941645580","20202893608044096791124949774349315572","165229511530923198138663292093310549636","223348011294678245660878046408810816469","324900586039617778497669082062963388034","63187830824006094765050704652296615372"],"threshold":0.9},"id":"ASB-A-416491779-266b8c58","signature_type":"Line","signature_version":"v1"},{"target":{"function":"finishOperationUnchecked","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"function_hash":"59196600810686604718954192125864229022","length":1104},"id":"ASB-A-416491779-b13332de","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9790eec7cdf44666eab10aebb8a28d41f9948854","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"finishProxyOperationImpl"},"deprecated":false,"digest":{"function_hash":"60043437227780985203000308944936520264","length":821},"id":"ASB-A-416491779-ccedb493"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416491779.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"111967766583563337480242246371989750843","length":3405},"id":"ASB-A-416491779-59ada09a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"verifyAndGetBypass"}},{"deprecated":false,"digest":{"function_hash":"302778091020712272410206182193732067432","length":1224},"id":"ASB-A-416491779-7b2236ca","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java","function":"finishOperationUnchecked"}},{"digest":{"function_hash":"88862171116627248423609488485975155833","length":849},"id":"ASB-A-416491779-c9ec0153","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f","target":{"function":"finishProxyOperationImpl","file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f","target":{"file":"services/core/java/com/android/server/appop/AppOpsService.java"},"deprecated":false,"digest":{"line_hashes":["145533244394736777395731452236992008948","309215926538045402602657564343502449411","212736499001916873285724335412318095409","140468702664407564615741072009711414593","111894624664285355382775798437093391310","36832147086446174073806500118908194327","67259588965742049087858546075940583252","213300930277564897353494739351679481071","176107377025305689034526358438740090604","79745726213375083831113428051279685537","141827826080887564643400668847525488327","266080197234080450483255357434435658099","96473944444397072355208669320627881184","198170298809086924941692793639245543997","67862067983392615665773527569907833010","258090797395468389451732751057449770439","225956139237626615904419152772393606133","286085259704673804422033465527098940917","165450472562439424311051595638473434928","237422163748034095650877695024740199813","126896969738788003213948840285398483375","326671246052218534208019850571232824079","198385719537384758387429535128527416772","315952819557544547305654039091072256369","335334773055924698587996816271197000479","142755240643133366352348226964143927718","122544624308948724187252201795294179415","1577266320319389897667113252356691913","245750786413319727894170518589327460774","110484453700089275035591506105064992793","161108383840385617822320201804815905892","14647373960907151971344084714157858522","262754680900253367976251405950549203304","198872632702529793301821859466264200115","217525580373318332542580908768624589425","116256911430510318547601549537866915458","51155141883239242627593694561320896375","334256952925092768415641147313273253070","327146297051040508688237695062253274717","229881087295695753805407895940465887942","308030141275839695269238968837200168390","117987537531020790817837648613375359968","31197032750000031620870360164106773875","106668003845575818094709242710479608026","147388735585732077698752243275182760238","228085740630932503487399084921443665430","305746464712692291170662939816387014396","132340738130790428793573747325850266128","257196362004999581498472046323076186034","99258469862926988714611812929941645580","20202893608044096791124949774349315572","165229511530923198138663292093310549636","223348011294678245660878046408810816469","324900586039617778497669082062963388034","63187830824006094765050704652296615372"],"threshold":0.9},"id":"ASB-A-416491779-facd8154"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/31cbe2099337785cf0ec012396550721c44e469f"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416491779.json"}}],"schema_version":"1.9.0"}