CVE-2025-48595 KEV
8.4
HIGH · CVSS 3.1 · EPSS 1.7% (pctl 76)
Patch first
On CISA KEV — known exploited in the wild, due 2026-06-05.
Description
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Scoring
| CVSS | 8.4 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 1.71% — more likely to be exploited than 76% of all CVEs |
| Weakness | CWE-190 |
| On CISA KEV | yes — remediate by 2026-06-05 |
| Public exploit | none known |
| Published | 2026-06-01 |
| Last modified | 2026-07-22 |
CISA KEV
| Name | Android Framework Integer Overflow Vulnerability |
|---|---|
| Added | 2026-06-02 |
| Due | 2026-06-05 |
| Vendor / product | Android / Framework |
| Ransomware use | none reported |
Affected (1)
| Vendor | Product |
|---|---|
| android |
References
→ the Explorer · watch your stack · NVD