CVE-2025-48530
Published: 04 September 2025
Summary
CVE-2025-48530 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Google Android. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-48530 is a vulnerability involving out-of-bounds (OOB) accesses due to an incorrect bounds check in multiple locations within Android components. Published on 2025-09-04, it is classified under CWE-125 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker requires no privileges or user interaction to exploit this over the network, though high attack complexity is needed. When combined with other bugs, it could result in remote code execution.
The Android security bulletin dated 2025-08-01 at https://source.android.com/security/bulletin/2025-08-01 provides details on affected versions and available patches for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-34010
Vulnerability details
In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is…
more
not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB memory corruption in Android network-exposed components directly enables remote exploitation for code execution (RCE) over the network with no auth/UI required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by identifying, reporting, and applying vendor patches that correct the incorrect bounds checks causing OOB accesses.
Implements memory protection safeguards such as non-executable memory and ASLR to prevent remote code execution from OOB accesses even if the bounds check flaw exists.
Enforces validation of information inputs including bounds checks to address the root cause of incorrect bounds handling in Android components.