Cyber Posture

CVE-2025-48613

HighLPE

Published: 02 March 2026

Published
02 March 2026
Modified
06 March 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0000 0.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48613 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Google Android. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Mandates digital signing and verification of boot components like VBMeta prior to execution, preventing use of modified or test-key resigned images for privilege escalation.

preventdetect

Verifies integrity of firmware and software including VBMeta, detecting and preventing unauthorized modifications or improper resigning that bypass verified boot.

prevent

Requires timely patching of the specific VBMeta verification flaw allowing test key resigning, as addressed in the Android Security Bulletin.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local privilege escalation via VBMeta modification in verified boot directly matches exploitation for privilege escalation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This could lead to local escalation of privilege with no additional execution privileges…

more

needed. User interaction is not needed for exploitation.

Deeper analysisAI

CVE-2025-48613 is a vulnerability in VBMeta, a component used in Android's verified boot process, that enables modification and resigning of VBMeta using a test key if the original image was previously signed with the same key. Published on March 2, 2026, it is rated 7.8 (High) under CVSS 3.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-269 (Improper Privilege Management). No additional execution privileges or user interaction are required for exploitation.

A local attacker with low privileges (PR:L) can exploit this vulnerability due to its low attack complexity (AC:L). Successful exploitation leads to local escalation of privilege, potentially granting high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).

The Android Security Bulletin for March 2026, available at https://source.android.com/docs/security/bulletin/2026/2026-03-01, addresses this issue with patches and mitigation guidance for affected Android versions.

Details

CWE(s)

Affected Products

google
android
all versions

CVEs Like This One

CVE-2024-49742Same product: Google Android
CVE-2025-48645Same product: Google Android
CVE-2026-0029Same product: Google Android
CVE-2026-0023Same product: Google Android
CVE-2026-0032Same product: Google Android
CVE-2025-48574Same product: Google Android
CVE-2025-36920Same product: Google Android
CVE-2026-0011Same product: Google Android
CVE-2026-0020Same product: Google Android
CVE-2026-0117Same product: Google Android

References