{"id":"ASB-A-426205822","details":"In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-426205822","CVE-2025-48576"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/b812baa1463c9f9e81efa617c9d08ed7a63488b4"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2025-12-01"}]}],"versions":["16-qpr2-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6077349a00fdac577592284eadddd18b73c0262e"],"severity":"High","spl":"2025-12-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/6077349a00fdac577592284eadddd18b73c0262e","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["156231198521029386367772624088264440536","166590874105198397400184752317366151185","142312285236974532748207548786544031864","224759384226269947634896476210768565128","273862767101193226214936188826193783458","160334047897406468878782098239296781360","259814483919499760002670504094810759732","139878874909356672422378716715190489330","257428999567353744636456650756597163865","147406559676856576040361899110836963861","210095457782704169357473347111716394756","232377478899324234260459727003642332215","265223815689037363549003814527889341008","289270476180375604764248269967787271920","7905508669504822563421408945645979942","237772547329364885356401856943482803845","119979962439139037617426161121650167944","222669569709145527623430150853794880862","267025157395555558592415365185653145256","278553020777735491722857509097993694220","246117460154104412709251356387301827344"],"threshold":0.9},"id":"ASB-A-426205822-9073851a","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":427,"function_hash":"89499826374144785962430699782045502392"},"id":"ASB-A-426205822-97639073","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6077349a00fdac577592284eadddd18b73c0262e","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"updateNotificationChannelGroupFromPrivilegedListener"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-426205822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-12-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["DoS"],"vanir_signatures":[{"id":"ASB-A-426205822-5a57f16e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4572210097f6d0fa87c33df218a30b6c8868e7bb","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["176441479915387707227313344909083853787","166590874105198397400184752317366151185","142312285236974532748207548786544031864","224759384226269947634896476210768565128","273862767101193226214936188826193783458","128568650583489736071598113486857788458","46368388901761796622481510279165214212","172560882202241314215144484613695339854","273245529857010963395257503193324442747","12475769459500934221664361078733686918","267025157395555558592415365185653145256","278553020777735491722857509097993694220","246117460154104412709251356387301827344"],"threshold":0.9}},{"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"updateNotificationChannelGroupFromPrivilegedListener"},"deprecated":false,"digest":{"length":255,"function_hash":"138959303660013668700300678030113879416"},"id":"ASB-A-426205822-953595a5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/4572210097f6d0fa87c33df218a30b6c8868e7bb"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/4572210097f6d0fa87c33df218a30b6c8868e7bb"],"severity":"High","spl":"2025-12-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-426205822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2025-12-01"}]}],"versions":["16"],"ecosystem_specific":{"spl":"2025-12-01","types":["DoS"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/6d846a1a76fd2a45cf4cd9575673db2644b153fc","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["156231198521029386367772624088264440536","166590874105198397400184752317366151185","142312285236974532748207548786544031864","224759384226269947634896476210768565128","273862767101193226214936188826193783458","128568650583489736071598113486857788458","46368388901761796622481510279165214212","172560882202241314215144484613695339854","273245529857010963395257503193324442747","12475769459500934221664361078733686918","267025157395555558592415365185653145256","278553020777735491722857509097993694220","246117460154104412709251356387301827344"],"threshold":0.9},"id":"ASB-A-426205822-17990d1e","signature_type":"Line","signature_version":"v1"},{"digest":{"length":255,"function_hash":"138959303660013668700300678030113879416"},"id":"ASB-A-426205822-bebd79cb","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/6d846a1a76fd2a45cf4cd9575673db2644b153fc","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"updateNotificationChannelGroupFromPrivilegedListener"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/6d846a1a76fd2a45cf4cd9575673db2644b153fc"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-426205822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-12-01"}]}],"versions":["13"],"ecosystem_specific":{"spl":"2025-12-01","types":["DoS"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/da8ca7555e8ec6c11193280fe656d3a725ecf914","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["176441479915387707227313344909083853787","166590874105198397400184752317366151185","142312285236974532748207548786544031864","224759384226269947634896476210768565128","273862767101193226214936188826193783458","128568650583489736071598113486857788458","46368388901761796622481510279165214212","172560882202241314215144484613695339854","273245529857010963395257503193324442747","12475769459500934221664361078733686918","267025157395555558592415365185653145256","278553020777735491722857509097993694220","246117460154104412709251356387301827344"],"threshold":0.9},"id":"ASB-A-426205822-242fde14","signature_type":"Line"},{"digest":{"function_hash":"138959303660013668700300678030113879416","length":255},"id":"ASB-A-426205822-f089264b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/da8ca7555e8ec6c11193280fe656d3a725ecf914","target":{"function":"updateNotificationChannelGroupFromPrivilegedListener","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/da8ca7555e8ec6c11193280fe656d3a725ecf914"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-426205822.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-12-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2025-12-01","types":["DoS"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["176441479915387707227313344909083853787","166590874105198397400184752317366151185","142312285236974532748207548786544031864","224759384226269947634896476210768565128","273862767101193226214936188826193783458","128568650583489736071598113486857788458","46368388901761796622481510279165214212","172560882202241314215144484613695339854","273245529857010963395257503193324442747","12475769459500934221664361078733686918","267025157395555558592415365185653145256","278553020777735491722857509097993694220","246117460154104412709251356387301827344"],"threshold":0.9},"id":"ASB-A-426205822-38dfa836","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/da8ca7555e8ec6c11193280fe656d3a725ecf914"},{"target":{"function":"updateNotificationChannelGroupFromPrivilegedListener","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"function_hash":"138959303660013668700300678030113879416","length":255},"id":"ASB-A-426205822-88d1b52e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/da8ca7555e8ec6c11193280fe656d3a725ecf914"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/da8ca7555e8ec6c11193280fe656d3a725ecf914"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-426205822.json"}}],"schema_version":"1.9.0"}