{"id":"ASB-A-433250316","details":"In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-433250316","CVE-2025-48615"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/a5795fc0cf1f21da88cf05ad06610d3653d1be0e"},{"type":"FIX","url":"https://android.googlesource.com/platform/frameworks/base/+/bb15e7f14f638ead9bfc57374e90f9f108f3a5e6"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"305563850185580115108354411695687246969","length":119},"id":"ASB-A-433250316-0d564cb3","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d09400d72573c2e6124ae28dd9bb68139c9598a5","target":{"function":"create","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"}},{"digest":{"function_hash":"110027193648202673734435363820180921253","length":824},"id":"ASB-A-433250316-12801026","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9062dd861d49627405804fcc9bb50fdae3701aa2","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"getComponentName"},"deprecated":false},{"id":"ASB-A-433250316-64aec4a5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d09400d72573c2e6124ae28dd9bb68139c9598a5","target":{"function":"getComponentName","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"length":1073,"function_hash":"67545669489154095972872735817127652284"}},{"id":"ASB-A-433250316-a8890fdb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/9062dd861d49627405804fcc9bb50fdae3701aa2","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"line_hashes":["76265195589156435221918127769755953211","276526323746428880070034851575922783642","196420733937550771678101222481264188820","146185787476171494501781730134872614686","113615912531183298708607721225902457649","88225773469190708710356365374856603172","105250676629162595975971209621853036513"],"threshold":0.9}},{"digest":{"line_hashes":["328751455745210324628619875951566033517","191163236989969452575255553709546613871","184835336153203277575062073235488285610","46232055690501423799074340694522499937","248773513423442155857191722417774964056","278182480583045294655514605074186682484","48676866334516991324510597713022518659","3919686937048534972561343138532381910","226942475320475994997359100244287609298","158874931228421919556317288995657361106","268095696980770714752125897306026102749","260149948220453429243393241480952813247","106574765195349430812517975005497759388","257265344195150026224288627514250446662","317758312416293064431340495348751639455","220884027888050459794073188008898298494","338977970396536511764307429473451749003","96211924728311530019092116063526096406","138691616646129565200741401901872739789"],"threshold":0.9},"id":"ASB-A-433250316-ad217b72","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/d09400d72573c2e6124ae28dd9bb68139c9598a5","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/9062dd861d49627405804fcc9bb50fdae3701aa2","https://android.googlesource.com/platform/frameworks/base/+/d09400d72573c2e6124ae28dd9bb68139c9598a5"],"severity":"High","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-433250316.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["76265195589156435221918127769755953211","276526323746428880070034851575922783642","196420733937550771678101222481264188820","146185787476171494501781730134872614686","113615912531183298708607721225902457649","88225773469190708710356365374856603172","105250676629162595975971209621853036513"]},"id":"ASB-A-433250316-17f83a41","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/97dc44c02a8866fa723b2640d172d5682193e6ee","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false},{"target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"getComponentName"},"deprecated":false,"digest":{"function_hash":"110027193648202673734435363820180921253","length":824},"id":"ASB-A-433250316-561d2ff0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/97dc44c02a8866fa723b2640d172d5682193e6ee"},{"digest":{"function_hash":"305563850185580115108354411695687246969","length":119},"id":"ASB-A-433250316-5dfe7380","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23c44648eaddf4cb17ff6b77975a5f43c1293048","target":{"function":"create","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false},{"id":"ASB-A-433250316-a73f4fa8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23c44648eaddf4cb17ff6b77975a5f43c1293048","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["328751455745210324628619875951566033517","191163236989969452575255553709546613871","184835336153203277575062073235488285610","46232055690501423799074340694522499937","248773513423442155857191722417774964056","278182480583045294655514605074186682484","48676866334516991324510597713022518659","3919686937048534972561343138532381910","226942475320475994997359100244287609298","158874931228421919556317288995657361106","268095696980770714752125897306026102749","260149948220453429243393241480952813247","106574765195349430812517975005497759388","257265344195150026224288627514250446662","317758312416293064431340495348751639455","220884027888050459794073188008898298494","338977970396536511764307429473451749003","96211924728311530019092116063526096406","138691616646129565200741401901872739789"]}},{"target":{"function":"getComponentName","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"length":1073,"function_hash":"67545669489154095972872735817127652284"},"id":"ASB-A-433250316-b0ba9b99","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/23c44648eaddf4cb17ff6b77975a5f43c1293048"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/97dc44c02a8866fa723b2640d172d5682193e6ee","https://android.googlesource.com/platform/frameworks/base/+/23c44648eaddf4cb17ff6b77975a5f43c1293048"],"severity":"High","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-433250316.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b769129921d76b8bd9ec7d2ed35e5044f362857d","target":{"function":"getComponentName","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"function_hash":"110027193648202673734435363820180921253","length":824},"id":"ASB-A-433250316-32649273"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daa9c35a13a854fc2a3a997f2cc4b486c5773373","target":{"function":"getComponentName","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"function_hash":"67545669489154095972872735817127652284","length":1073},"id":"ASB-A-433250316-47adca6a"},{"digest":{"line_hashes":["76265195589156435221918127769755953211","276526323746428880070034851575922783642","196420733937550771678101222481264188820","146185787476171494501781730134872614686","113615912531183298708607721225902457649","88225773469190708710356365374856603172","105250676629162595975971209621853036513"],"threshold":0.9},"id":"ASB-A-433250316-ad4136bd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/b769129921d76b8bd9ec7d2ed35e5044f362857d","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daa9c35a13a854fc2a3a997f2cc4b486c5773373","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"line_hashes":["328751455745210324628619875951566033517","191163236989969452575255553709546613871","184835336153203277575062073235488285610","46232055690501423799074340694522499937","248773513423442155857191722417774964056","278182480583045294655514605074186682484","48676866334516991324510597713022518659","3919686937048534972561343138532381910","226942475320475994997359100244287609298","158874931228421919556317288995657361106","268095696980770714752125897306026102749","260149948220453429243393241480952813247","106574765195349430812517975005497759388","257265344195150026224288627514250446662","317758312416293064431340495348751639455","220884027888050459794073188008898298494","338977970396536511764307429473451749003","96211924728311530019092116063526096406","138691616646129565200741401901872739789"],"threshold":0.9},"id":"ASB-A-433250316-ca7754ca","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/daa9c35a13a854fc2a3a997f2cc4b486c5773373","target":{"function":"create","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"length":119,"function_hash":"305563850185580115108354411695687246969"},"id":"ASB-A-433250316-e8b49d9a"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/b769129921d76b8bd9ec7d2ed35e5044f362857d","https://android.googlesource.com/platform/frameworks/base/+/daa9c35a13a854fc2a3a997f2cc4b486c5773373"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-433250316.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"id":"ASB-A-433250316-7fc4ffdd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fc09c5fa8cc6bd1a33884abc2c2149b21c56da7a","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"line_hashes":["328751455745210324628619875951566033517","191163236989969452575255553709546613871","184835336153203277575062073235488285610","46232055690501423799074340694522499937","248773513423442155857191722417774964056","278182480583045294655514605074186682484","48676866334516991324510597713022518659","3919686937048534972561343138532381910","226942475320475994997359100244287609298","158874931228421919556317288995657361106","268095696980770714752125897306026102749","260149948220453429243393241480952813247","106574765195349430812517975005497759388","257265344195150026224288627514250446662","317758312416293064431340495348751639455","220884027888050459794073188008898298494","338977970396536511764307429473451749003","96211924728311530019092116063526096406","138691616646129565200741401901872739789"],"threshold":0.9}},{"deprecated":false,"digest":{"length":1073,"function_hash":"67545669489154095972872735817127652284"},"id":"ASB-A-433250316-d14e3717","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fc09c5fa8cc6bd1a33884abc2c2149b21c56da7a","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"getComponentName"}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fc09c5fa8cc6bd1a33884abc2c2149b21c56da7a","target":{"function":"create","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"function_hash":"305563850185580115108354411695687246969","length":119},"id":"ASB-A-433250316-d44ccb96"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fc09c5fa8cc6bd1a33884abc2c2149b21c56da7a"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-433250316.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"digest":{"line_hashes":["76265195589156435221918127769755953211","276526323746428880070034851575922783642","196420733937550771678101222481264188820","146185787476171494501781730134872614686","113615912531183298708607721225902457649","88225773469190708710356365374856603172","105250676629162595975971209621853036513"],"threshold":0.9},"id":"ASB-A-433250316-04ce5e42","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dc3e39c1b5fa962c6f4dfa0d5855d6c3f0c33a1f","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"110027193648202673734435363820180921253","length":824},"id":"ASB-A-433250316-4410997d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/dc3e39c1b5fa962c6f4dfa0d5855d6c3f0c33a1f","target":{"function":"getComponentName","file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/013bb57034ee44eb4bcaf6e808732b6f1eb780b0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java"},"deprecated":false,"digest":{"line_hashes":["328751455745210324628619875951566033517","191163236989969452575255553709546613871","184835336153203277575062073235488285610","46232055690501423799074340694522499937","248773513423442155857191722417774964056","278182480583045294655514605074186682484","48676866334516991324510597713022518659","3919686937048534972561343138532381910","226942475320475994997359100244287609298","158874931228421919556317288995657361106","268095696980770714752125897306026102749","260149948220453429243393241480952813247","106574765195349430812517975005497759388","257265344195150026224288627514250446662","317758312416293064431340495348751639455","220884027888050459794073188008898298494","338977970396536511764307429473451749003","96211924728311530019092116063526096406","138691616646129565200741401901872739789"],"threshold":0.9},"id":"ASB-A-433250316-64d580b8"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/013bb57034ee44eb4bcaf6e808732b6f1eb780b0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"getComponentName"},"deprecated":false,"digest":{"function_hash":"67545669489154095972872735817127652284","length":1073},"id":"ASB-A-433250316-ee8843e4","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/013bb57034ee44eb4bcaf6e808732b6f1eb780b0","target":{"file":"services/core/java/com/android/server/media/MediaButtonReceiverHolder.java","function":"create"},"deprecated":false,"digest":{"function_hash":"305563850185580115108354411695687246969","length":119},"id":"ASB-A-433250316-f0d9f449","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/dc3e39c1b5fa962c6f4dfa0d5855d6c3f0c33a1f","https://android.googlesource.com/platform/frameworks/base/+/013bb57034ee44eb4bcaf6e808732b6f1eb780b0"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-433250316.json"}}],"schema_version":"1.9.0"}