CVE-2025-48579: 
NixOS vulnerability analysis and mitigation

CVE-2025-48579 is a confused deputy vulnerability in Android's MediaProvider.java that allows a local attacker to bypass external storage write permission checks, leading to local escalation of privilege. It affects Android versions 14.0, 15.0, and 16.0. No additional execution privileges or user interaction are required for exploitation. The vulnerability carries a CVSS v3.1 base score of 8.4 (High) (Android Security Bulletin, Red Hat Advisory). It was published on March 2, 2026, and a patch was included in the March 2026 Android Security Bulletin.

The root cause is classified as CWE-441 (Unintended Proxy or Intermediary — 'Confused Deputy'), where multiple functions in MediaProvider.java fail to properly enforce external storage write permission checks, allowing a less-privileged component to act on behalf of a more-privileged one (Android Security Bulletin). An attacker with local access to the device can invoke these functions to write to external storage areas that should be restricted by Android's permission model, without holding the required write permissions. The attack vector is local, with low complexity, and requires no privileges or user interaction, making it straightforward to exploit once local code execution is achieved.

Successful exploitation allows a local attacker to bypass Android's external storage write permission controls, gaining unauthorized read and write access to external storage. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, meaning an attacker could read sensitive files, overwrite or corrupt data, and potentially disrupt device functionality (Android Security Bulletin). This could facilitate further privilege escalation, data theft, or installation of malicious content on the device's external storage.

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is extremely low at 0.000020, reflecting minimal current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Google released a patch for Android 14.0, 15.0, and 16.0 in the March 2026 Android Security Bulletin (patch level 2026-03-01) (Android Security Bulletin). Device owners and administrators should apply the March 2026 security update as soon as it is available for their device. As a general precaution, restricting physical access to devices and limiting installation of untrusted applications reduces the risk of local exploitation. Samsung devices received the patch as part of the Samsung March 2026 security patch (SammyFans).

The CIS issued an advisory noting multiple vulnerabilities in the March 2026 Google Android OS update, including CVE-2025-48579, flagging the potential for privilege escalation (CIS Advisory). Huawei also referenced the vulnerability in its April 2026 security bulletin, indicating broad OEM awareness (Huawei Bulletin). Community and media coverage has been limited, consistent with the absence of active exploitation.