{"id":"ASB-A-416734088","details":"In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-416734088","CVE-2025-48540"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/91aec28d0f5979d083b46e02e87c0b7d2e2587d2"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/300a057414d7705457370bd07199bef92526f84a"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/native/+/a9e6d5a3c6797ad715a0e54a472c58a0c9468215"}],"affected":[{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/dddbc115f88d99379ad9e118e551924c84f16e3a","https://android.googlesource.com/platform/frameworks/native/+/18418acef92fbac73c5bdff406be602538d63d5e"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"libs/binder/RpcState.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["47325437905454957186145303263316668173","259253569551469703788423823481042338470","196398602023098459524797281988712547302","222006022464640773177968993079592901673"]},"id":"ASB-A-416734088-a5c7492a","match_only_versions":["16-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/dddbc115f88d99379ad9e118e551924c84f16e3a"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200613136110416278552865857805311066181","176590158862339272001493394686067151642","101084473771872790407090547667744203688","15511548513367162275232702306558673738","136615767537081965220112285800463477660","269014513090203517196004904486105953389","179288712230732552680460278598446256105","249148489983205371758225527999332437754","337093262807040740427438628674586694882","80449960023012013829625744998946056834","53964558402843490528829849987980934409","315691633233126500566220387452738506963","44690771115353556261770892115514164040","86040920378360008327654478503098295645","114138067560058065507930119170833637133","280872852507265149181943432534224407865","279698520006409471869459035876716376877","150588941962931015033991767166010655385","115139876018247479610828010701584930369","229390154054914087897823397725064947590","310179796299737968666907094043022058349","163996051623379311184401854825156692164","252864891061637375311723049799627291634","35742382309125555052346426328833803084","279124942607794226609991414453183164444","86859997937893779633882711393713493393","125786755414956536816273554868333546035","278611756351004280550258876465381502131","202180768608848258530197265160901189731","193830466650420406331202216995318189214","75773102145393288928288002980033110391","132934724878628617808868402565747502497","82358998742196800535770706118346912260","313681082168121079235492691083918917287","217455910739439710539974710487046770506","106786724265397661585562454622054714057","112761981601215926436663164109340934073","302820137264701712087789314517472096388","292457715150323702360969804615961211047","156621480443780267731625448227859971712","231689277821651576918706614552226481118","218516344064025139695827907742279953959","164454001549279491117882826018810518962","214012057948679872117849896923057255631","196506936149879195430158557604961053702","210226503878164329466142730749373246164","312520858278206799944929817268850785773","129942015225434175829205656996444658465","189683296025022818088398855230398278340","326642643990010299203299502892326160289","77061505643818377146276015294800669937","163812453705103859145478566394065982122","95633233113206127146052990485625268103","312871277894734370518417686301671115073","273769667020406485771949634331689060212"]},"id":"ASB-A-416734088-e8b739d0","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/18418acef92fbac73c5bdff406be602538d63d5e","target":{"file":"libs/binder/RpcState.cpp"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416734088.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-416734088-06541e22","match_only_versions":["15"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/2ecd04b6d50cbe4b45abeb4c4a3c265a075f90c5","target":{"file":"libs/binder/RpcState.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["268677915571252491787957938962455238868","297296428507614017555822049364918574593","313883999151140304965205792496624909399","166290292979860924341526236734814495255"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/fdac9eb76a39ce82deb3ab4c16083a74083435ab","https://android.googlesource.com/platform/frameworks/native/+/58ace57b16a943b42c9b09d6230e9471acda39cb","https://android.googlesource.com/platform/frameworks/native/+/2ecd04b6d50cbe4b45abeb4c4a3c265a075f90c5"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416734088.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/native/+/1919a8894006e9bac60ef76041e8034c4e41d36d","https://android.googlesource.com/platform/frameworks/native/+/1a137c15a441ba1c3b0cbc402fafd21751be0ff9","https://android.googlesource.com/platform/frameworks/native/+/408c7222606cac46b8bf4dc4adc31bab92a9d9f3"],"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"match_only_versions":["16"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/408c7222606cac46b8bf4dc4adc31bab92a9d9f3","target":{"file":"libs/binder/RpcState.cpp"},"deprecated":false,"digest":{"line_hashes":["268677915571252491787957938962455238868","297296428507614017555822049364918574593","313883999151140304965205792496624909399","166290292979860924341526236734814495255"],"threshold":0.9},"id":"ASB-A-416734088-8cd39074"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416734088.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/b5c6db489e142db249efb771acf3206a54186231","target":{"file":"libs/binder/RpcState.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["82602933077280034341571965467582360852","223157660082466408275189295893713335958","192569470619134747206059392508910072734","211489903248442465257077629320886353676"]},"id":"ASB-A-416734088-e638c2d4","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/7affacbd7e336008a4a39f45e31eb8a4a8a52c01","https://android.googlesource.com/platform/frameworks/native/+/b5c6db489e142db249efb771acf3206a54186231"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416734088.json"}},{"package":{"name":"platform/frameworks/native","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/native/+/5f498ab7e87fdbb611f3046e0563bf05ea0868d1","target":{"file":"libs/binder/RpcState.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["124618876266657369684838120013021025464","112344690463600555281382791349454309322","106310551423874871216275059101271202462","197437750436761921358970484790130333585","182923409850843967176622652119597210348","175565552889384707650993463990234767184","278370607762177927467439479194188167942","162967655731418987381589042042075181744"]},"id":"ASB-A-416734088-afdd350f","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/native/+/b8a68bb275529bfcd4fd5ca5f984a2cc764f121a","https://android.googlesource.com/platform/frameworks/native/+/9d14bfee6c3bf95c6d7ea6a2ec68f6cdf4082ba7","https://android.googlesource.com/platform/frameworks/native/+/5f498ab7e87fdbb611f3046e0563bf05ea0868d1"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-416734088.json"}}],"schema_version":"1.9.0"}