CVE-2025-48585: 
NixOS vulnerability analysis and mitigation

CVE-2025-48585 is a persistent denial-of-service vulnerability in Android's ProfilingService.java caused by improper input validation. It affects Google Android 16.0 (including QPR2 Beta 1, Beta 2, and Beta 3 variants) and can be triggered locally without any additional privileges or user interaction. The vulnerability was published on March 2, 2026, and addressed in the Google Android Security Bulletin for 2026-03-01. It carries a CVSS v3.1 base score of 6.2 (Medium) (Android Security Bulletin, Red Hat CVE).

The root cause is improper input validation (CWE-20) in multiple functions within ProfilingService.java, a component of the Android operating system responsible for device profiling operations. An attacker with local access can supply maliciously crafted input to these functions, causing the service to enter a persistent failure state that survives reboots or normal recovery mechanisms. No elevated privileges are required, and the attack vector is entirely local, meaning physical or logical access to the device is a prerequisite. No public technical write-ups or proof-of-concept code have been identified (Android Security Bulletin, Red Hat CVE).

Successful exploitation results in a persistent denial of service, rendering the affected Android device or the ProfilingService component unavailable in a way that persists beyond normal restarts. There is no impact on confidentiality or integrity — only availability is affected. The scope is limited to the local device, with no evidence of lateral movement potential or data exposure risk (Android Security Bulletin).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is extremely low at approximately 0.000020, reflecting a very low probability of exploitation in the near term (Red Hat CVE, Android Security Bulletin).

Google has released a patch addressing this vulnerability in the Android Security Bulletin dated 2026-03-01, published March 2, 2026. Users and administrators should apply the March 2026 security patch level (2026-03-01 or later) to all affected Android 16.0 devices. No configuration-based workarounds have been published; upgrading to the patched security patch level is the recommended remediation (Android Security Bulletin).

The CIS published an advisory noting multiple vulnerabilities in the March 2026 Android update, including CVE-2025-48585, and recommended applying patches promptly (CIS Advisory). Security news outlets such as GBHackers covered the broader March 2026 Android security update, which addressed 129 flaws in total (GBHackers). No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified.