{"id":"ASB-A-425662627","details":"In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-425662627","CVE-2025-48584"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/08a0766708db2071d9b8b65abf40d7e8057daaa1"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"function_hash":"234157392479211378466761526158057311704","length":686},"id":"ASB-A-425662627-25ff17b1","match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"handleOnPackageChanged"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"writePolicyXml"},"deprecated":false,"digest":{"function_hash":"194161223105844991819985343020321659921","length":854},"id":"ASB-A-425662627-35923fc6"},{"deprecated":false,"digest":{"function_hash":"236687273776736459921012597639754413833","length":450},"id":"ASB-A-425662627-564a92e4","match_only_versions":["16-qpr2-next"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5","target":{"function":"verifyPrivilegedListener","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}},{"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"dumpImpl"},"deprecated":false,"digest":{"function_hash":"230845005169053885051609618412741189710","length":3870},"id":"ASB-A-425662627-668f75a9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5"},{"id":"ASB-A-425662627-9a198792","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5","target":{"function":"readPolicyXml","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"function_hash":"51441746281777270432991826738923173889","length":2395}},{"id":"ASB-A-425662627-b3fdf57c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["135897995689547516737237041093398459449","315583297743766064403846624255496421644","29405189250986547264372506327246430113","248386281050458130841695852976201213703","6246270668136625667263304486828972794","61704417962315293677064402596627918964","275525267369431763447644155682396000832","118131333017442368551233868361462706257","160919767251381168083297441914984133205","51249338142106732387578731125624804046","308765082829924402664006223119980114742","79184197438043920790041538467868314992","321835745768518061969458498309778881578","120493492971949544798728095518210738924","193485692543348974723692229675222377056","57690496347083817861931983046483405339","321890763064572525593091080770616968447","253111609355490117505618126483672602706","132223446513184398529684134213997197102","323988556313602404096970729079012055077","69719909794668805257984661293177042133","337908832011880663982781134489876166346","21321185561142904723273672095743516100","76601098041952395853029272204077707036","273546519276946742867236508161841542350","166631108232350128403885171794941088982","5073060024208290118250435614712143650","302542079501598894460537095162238162660","38883391852170297788732782796914227811","67545103514159469726136617047163561909","54638990873883298797259168267593230732","160874767781921076441051319796600415711","1369961732512278772026676522092717654","102376606943945088811267269929636996864","302093233342329294811118101705222711546","324929793847710292233519990170661256903","247468369077076969332123355539916591511","235991498533981192545553484633134625638","336454789701125748341567265125528059441","155533172812210934999856244558002337271","283766130607990779691835984674849535740","134522193208289409475764077329065961078","322561520036952031065636078135668936537","63467155925781295879605358474143372906","58421842729245059654982645042670428159","339114642993279899730468340492467598082","196284760059804432855141295903114244641","156463256223246381330264704958068571725","269394482417875729206798185141141308154","47993424825094646499213989689962774794","12388781355726896604721928673155496117","72710866419591529357307557042678401912","171462002755766493021670502272282575843","9825033146504705621527601067519516772","323138023984174369172506553835522716798","139977363228322583351830122794130331260","184678809655267179201945324765719473223","22301407107353183309674913959583939525","121813856793007137905069713448844733541","270688708793911316621425373886337141947","72726235945082728170932274335277372375","159076213996554715783557481413811683534","199214615883718237785270177822812185647","175026750667742199915631714688522293957","177434955818358344592956625894641102730","84948096829824679346122913859082908474","134226139381065426882122098982281036398","81462634743453177432493912645195300983","216061055908474923009522425213533370485","256481087164918290579263625397188400605","111251792567390295708392436146538013635","130501159583426063565927317597782085077","34181740895323194935191489585816328269","2269420210310684519317793485936761916"],"threshold":0.9}},{"id":"ASB-A-425662627-ba3bf308","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"onStart"},"deprecated":false,"digest":{"length":3005,"function_hash":"82638517559702168265842320378771425487"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"init"},"deprecated":false,"digest":{"function_hash":"55061854829876695296635705178976216544","length":9250},"id":"ASB-A-425662627-e1c87534","signature_type":"Function"},{"target":{"function":"createConversationNotificationChannelForPackageFromPrivilegedListener","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"length":1022,"function_hash":"23551821650618922045207646444283433796"},"id":"ASB-A-425662627-f9fe94fb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5"],"severity":"High","spl":"2025-12-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-425662627.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"dumpImpl"},"deprecated":false,"digest":{"function_hash":"135596783293236406347658140469984563398","length":3902},"id":"ASB-A-425662627-63e7dc51","signature_type":"Function","signature_version":"v1"},{"target":{"function":"createConversationNotificationChannelForPackageFromPrivilegedListener","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"function_hash":"42921360810459001151030940469014118579","length":736},"id":"ASB-A-425662627-8de63aae","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05"},{"target":{"function":"writePolicyXml","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"length":854,"function_hash":"194161223105844991819985343020321659921"},"id":"ASB-A-425662627-9340d0ff","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05"},{"match_only_versions":["16"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05","target":{"function":"verifyPrivilegedListener","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"function_hash":"236687273776736459921012597639754413833","length":450},"id":"ASB-A-425662627-cc781f12"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"readPolicyXml"},"deprecated":false,"digest":{"length":2395,"function_hash":"51441746281777270432991826738923173889"},"id":"ASB-A-425662627-dca5ad82","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["135897995689547516737237041093398459449","315583297743766064403846624255496421644","29405189250986547264372506327246430113","248386281050458130841695852976201213703","6246270668136625667263304486828972794","61704417962315293677064402596627918964","275525267369431763447644155682396000832","118131333017442368551233868361462706257","160919767251381168083297441914984133205","51249338142106732387578731125624804046","308765082829924402664006223119980114742","79184197438043920790041538467868314992","323442239760031026575201511897767727028","160234294633955345409021255675406467455","13291824750132431422749821631835117311","222976519158713685181886236704992935711","321890763064572525593091080770616968447","253111609355490117505618126483672602706","132223446513184398529684134213997197102","323988556313602404096970729079012055077","152942684572397017710583860686318174106","312798707272331405955179836554379373399","314494733642689879143834171809681860791","8675371721318526816699281374037052830","273546519276946742867236508161841542350","9207063480862443880321720692808695401","247598298467561954723884588845967486314","134349106886321940339019943351053682229","54638990873883298797259168267593230732","160874767781921076441051319796600415711","1369961732512278772026676522092717654","102376606943945088811267269929636996864","302093233342329294811118101705222711546","324929793847710292233519990170661256903","247468369077076969332123355539916591511","235991498533981192545553484633134625638","336454789701125748341567265125528059441","155533172812210934999856244558002337271","283766130607990779691835984674849535740","134522193208289409475764077329065961078","322561520036952031065636078135668936537","63467155925781295879605358474143372906","58421842729245059654982645042670428159","339114642993279899730468340492467598082","196284760059804432855141295903114244641","156463256223246381330264704958068571725","269394482417875729206798185141141308154","47993424825094646499213989689962774794","12388781355726896604721928673155496117","72710866419591529357307557042678401912","171462002755766493021670502272282575843","9825033146504705621527601067519516772","323138023984174369172506553835522716798","139977363228322583351830122794130331260","184678809655267179201945324765719473223","22301407107353183309674913959583939525","121813856793007137905069713448844733541","270688708793911316621425373886337141947","72726235945082728170932274335277372375","159076213996554715783557481413811683534","199214615883718237785270177822812185647","175026750667742199915631714688522293957","177434955818358344592956625894641102730","84948096829824679346122913859082908474","134226139381065426882122098982281036398","81462634743453177432493912645195300983","216061055908474923009522425213533370485","256481087164918290579263625397188400605","111251792567390295708392436146538013635","130501159583426063565927317597782085077","34181740895323194935191489585816328269","2269420210310684519317793485936761916"]},"id":"ASB-A-425662627-de1da1a6","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"init"},"deprecated":false,"digest":{"function_hash":"223711100670863851982664216029820943180","length":8999},"id":"ASB-A-425662627-df08914e"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05","target":{"function":"handleOnPackageChanged","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"function_hash":"234157392479211378466761526158057311704","length":686},"id":"ASB-A-425662627-e608b2b5","match_only_versions":["16"]},{"id":"ASB-A-425662627-eacbd517","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"onStart"},"deprecated":false,"digest":{"function_hash":"322136027155435506284165115064793340624","length":2886}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05"],"severity":"High","spl":"2025-12-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-425662627.json"}}],"schema_version":"1.9.0"}