{"id":"ASB-A-418773283","details":"In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-418773283","CVE-2025-48522"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-09-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/eb3cf182f9299ddf4013db10881614395b2b8965"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-next:0"},{"fixed":"16-next:2025-09-01"}]}],"versions":["16-next"],"ecosystem_specific":{"spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"core/java/android/companion/AssociationRequest.java","function":"setDisplayName"},"deprecated":false,"digest":{"function_hash":"131242640319249840870459432381464476378","length":109},"id":"ASB-A-418773283-80ada0a5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dfcbd34e7f03a8b96703ff6597cb2632c5c8d9bf"},{"target":{"file":"core/java/android/companion/AssociationRequest.java"},"deprecated":false,"digest":{"line_hashes":["269440801812699585152712414328242547405","330366624732347292350881135963890224103","69159395343701757787123535336040608901","68152038822025007295096070680134140672","27497242389120439899131387549726078270","269559521383832928557216591421670336542","219199137087090509060771178972907945050"],"threshold":0.9},"id":"ASB-A-418773283-c8929c7f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dfcbd34e7f03a8b96703ff6597cb2632c5c8d9bf"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dfcbd34e7f03a8b96703ff6597cb2632c5c8d9bf"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418773283.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-09-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"131242640319249840870459432381464476378","length":109},"id":"ASB-A-418773283-a4cd565c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b73847cdfeb6acbb21b70fc979c9c8cb6038bcfb","target":{"function":"setDisplayName","file":"core/java/android/companion/AssociationRequest.java"}},{"id":"ASB-A-418773283-cba41346","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b73847cdfeb6acbb21b70fc979c9c8cb6038bcfb","target":{"file":"core/java/android/companion/AssociationRequest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["147269419953227440488681118598688817780","52548465390990484745093659737434703888","25730624046464827620604150295925541558","68152038822025007295096070680134140672","27497242389120439899131387549726078270","269559521383832928557216591421670336542","219199137087090509060771178972907945050"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b73847cdfeb6acbb21b70fc979c9c8cb6038bcfb"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418773283.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-09-01"}]}],"versions":["16"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/4234c17b14d65c4cea54c9a4ff119029595e9867","target":{"file":"core/java/android/companion/AssociationRequest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["167141864808449554181499016020616283956","16081820404547247029385266116351825668","216724245081984099851929058632594725358","68152038822025007295096070680134140672","27497242389120439899131387549726078270","269559521383832928557216591421670336542","219199137087090509060771178972907945050"]},"id":"ASB-A-418773283-25a38058","signature_type":"Line","signature_version":"v1"},{"target":{"function":"setDisplayName","file":"core/java/android/companion/AssociationRequest.java"},"deprecated":false,"digest":{"function_hash":"131242640319249840870459432381464476378","length":109},"id":"ASB-A-418773283-8605b3b9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4234c17b14d65c4cea54c9a4ff119029595e9867"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4234c17b14d65c4cea54c9a4ff119029595e9867"],"severity":"High","spl":"2025-09-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418773283.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-09-01"}]}],"versions":["13"],"ecosystem_specific":{"severity":"High","spl":"2025-09-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bf97b0b070dc2239b556ea7726c20957f4140129","target":{"file":"core/java/android/companion/AssociationRequest.java"},"deprecated":false,"digest":{"line_hashes":["68152038822025007295096070680134140672","27497242389120439899131387549726078270","269559521383832928557216591421670336542","219199137087090509060771178972907945050"],"threshold":0.9},"id":"ASB-A-418773283-18389b78","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/bf97b0b070dc2239b556ea7726c20957f4140129","target":{"file":"core/java/android/companion/AssociationRequest.java","function":"setDisplayName"},"deprecated":false,"digest":{"function_hash":"131242640319249840870459432381464476378","length":109},"id":"ASB-A-418773283-1f6ac4aa","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/bf97b0b070dc2239b556ea7726c20957f4140129"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418773283.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-09-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["68152038822025007295096070680134140672","27497242389120439899131387549726078270","269559521383832928557216591421670336542","219199137087090509060771178972907945050"],"threshold":0.9},"id":"ASB-A-418773283-0c576ff9","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c770b9ef1fcb471aa6e24d6ffbcf61cda61363b7","target":{"file":"core/java/android/companion/AssociationRequest.java"}},{"digest":{"function_hash":"131242640319249840870459432381464476378","length":109},"id":"ASB-A-418773283-ec77d9eb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/c770b9ef1fcb471aa6e24d6ffbcf61cda61363b7","target":{"file":"core/java/android/companion/AssociationRequest.java","function":"setDisplayName"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/c770b9ef1fcb471aa6e24d6ffbcf61cda61363b7"],"severity":"High","spl":"2025-09-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-418773283.json"}}],"schema_version":"1.9.0"}