CVE-2025-48611
Published: 10 March 2026
Summary
CVE-2025-48611 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Google Android. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-48611 is a vulnerability in the DeviceId component implemented in DeviceId.java, where a missing bounds check enables a desync in persistence. This issue, classified under CWE-120, affects Android Pixel devices and was published on 2026-03-10. It carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with potential for high-impact effects across confidentiality, integrity, and availability.
The vulnerability enables local escalation of privilege without requiring additional execution privileges or user interaction. Given the CVSS vector's network attack vector (AV:N) and lack of privileges (PR:N), an unprivileged attacker could potentially trigger it remotely, achieving privilege escalation on the affected device with changed scope (S:C).
Mitigation details are provided in the Android Pixel security bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208516
Vulnerability details
In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow (CWE-120) in DeviceId component directly enables privilege escalation on Android without user interaction or additional privileges.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation including bounds checks on inputs to the DeviceId component, directly preventing the desync in persistence due to the missing bounds check.
Implements memory protections that restrict unauthorized memory access and detect attempts, mitigating exploitation of the missing bounds check leading to privilege escalation.
Enforces process isolation to contain the impact of local privilege escalation resulting from the DeviceId persistence desync vulnerability.