CVE-2025-48587: 
NixOS vulnerability analysis and mitigation

CVE-2025-48587 is an improper input validation vulnerability in Android's ProfilingService.java that enables a persistent local denial of service. It affects Google Android 16.0 and was disclosed via the Google Android March 2026 Security Bulletin (patch level 2026-03-01), published on March 2, 2026. No elevated privileges or user interaction are required for exploitation. It carries a CVSS v3.1 base score of 6.2 (Medium) (Android Bulletin, Red Hat CVE).

The vulnerability is rooted in improper input validation (CWE-20) across multiple functions within ProfilingService.java in Android 16.0. An attacker with local access can supply malformed or unexpected input to these functions, causing the ProfilingService to enter a persistent failure state — meaning the denial of service survives across normal recovery attempts. The attack vector is local, requires no privileges, and no user interaction, making it exploitable by any unprivileged local process or application on the device (Android Bulletin, Red Hat CVE).

Successful exploitation results in a persistent denial of service affecting the Android ProfilingService, with high availability impact and no confidentiality or integrity impact. Because the denial of service is described as "persistent," the service remains unavailable even after typical restart attempts, potentially requiring a device reboot or patch application to restore normal operation. The scope is limited to the local device; there is no evidence of lateral movement potential or data exposure risk (Android Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is extremely low at 0.000020 (approximately 0.002%), reflecting minimal probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Google has released a patch addressing this vulnerability in the Android March 2026 Security Bulletin at patch level 2026-03-01. Affected devices running Android 16.0 should be updated to the March 2026 security patch level or later as soon as it is available from the device manufacturer. As a secondary measure, restricting local access to ProfilingService where architecturally feasible can reduce exposure. Samsung and other OEMs have begun incorporating this patch into their March 2026 security updates (Android Bulletin, SammyFans).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in the Google Android OS March 2026 bulletin, including CVE-2025-48587, flagging the broader bulletin for potential remote code execution risks from other included CVEs (CIS Advisory). No notable independent researcher commentary or significant social media discussion specific to this CVE has been observed, consistent with its medium severity and lack of public exploit.