CVE-2025-48647
Published: 16 January 2026
Summary
CVE-2025-48647 is a high-severity Improper Input Validation (CWE-20) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-48647 is a memory overwrite vulnerability stemming from improper input validation in the cpm_fwtp_msg_handler function within cpm/google/lib/tracepoint/cpm_fwtp_ipc.c. This issue affects Android devices, particularly Google Pixel models as detailed in the associated security bulletin. Classified under CWE-20 (Improper Input Validation), it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-01-16.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Exploitation enables local escalation of privilege without needing additional execution privileges, potentially granting full system control through high-impact confidentiality, integrity, and availability violations.
The Android Security Bulletin for Pixel devices, available at https://source.android.com/docs/security/bulletin/pixel/2026/2026-01-01, provides details on patches addressing this vulnerability. Security practitioners should apply these updates promptly to mitigate risks on affected devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2876
Vulnerability details
In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory overwrite from improper input validation directly enables local privilege escalation to full system control on Android.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper input validation in cpm_fwtp_msg_handler that enables memory overwrite and local privilege escalation.
Implements memory safeguards to protect against unauthorized memory overwrites exploited by this vulnerability.
Ensures identification, reporting, and correction of flaws like this memory overwrite vulnerability through timely patching as recommended in the Android bulletin.