CVE-2025-48591: 
NixOS vulnerability analysis and mitigation

CVE-2025-48591 is a missing permission check vulnerability in Android that allows a local attacker to read files belonging to another user, resulting in local information disclosure. It affects Android versions 13.0, 14.0, and 15.0, with the flaw present in multiple locations including the frameworks/base and packages/services/Mms components. The vulnerability was disclosed on December 8, 2025, with a patch made available in the December 2025 Android Security Bulletin. It carries a CVSS v3.1 base score of 5.5 (Medium) (Android Security Bulletin).

The root cause is classified as CWE-862 (Missing Authorization): in multiple code locations within Android's framework and MMS service, file access operations lack the necessary permission checks to enforce user isolation. An attacker with a low-privileged local account can exploit this without any user interaction or elevated privileges, simply by invoking the affected APIs or accessing the relevant file paths. Patches were committed to android.googlesource.com/platform/frameworks/base and android.googlesource.com/platform/packages/services/Mms (Android Security Bulletin).

Successful exploitation leads to local information disclosure, allowing a low-privileged user or application to read files owned by other users on the same device. This could expose sensitive personal data, messages (including MMS content), or application files belonging to other accounts. There is no impact on integrity or availability, and the scope is limited to the affected device (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires only a low-privileged local account and no user interaction, lowering the barrier for exploitation if access to the device is obtained. The EPSS score is approximately 0.006%, reflecting a low probability of near-term exploitation. CVE-2025-48591 is not listed in the CISA Known Exploited Vulnerabilities catalog (Android Security Bulletin).

Google has addressed this vulnerability in the December 2025 Android Security Bulletin (patch level 2025-12-01). Users and administrators should apply the December 2025 Android security update to all affected devices running Android 13, 14, or 15. No configuration-based workaround has been published; updating to the patched security patch level is the recommended remediation (Android Security Bulletin).

The vulnerability was noted in routine coverage of the December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. Security news outlets such as BeyondMachines and TheCyberThrone covered the bulletin broadly, and Samsung's October 2025 update was also noted as addressing related Android issues. No significant independent researcher commentary or social media discussion specific to CVE-2025-48591 has been observed (Android Security Bulletin).