CVE-2025-48596: 
NixOS vulnerability analysis and mitigation

CVE-2025-48596 is a local privilege escalation vulnerability in Android's Parcel.cpp caused by an out-of-bounds read in the appendFrom function due to a missing bounds check. It affects Android versions 13.0, 14.0, 15.0, and 16.0. The vulnerability was disclosed on December 8, 2025, with a patch included in the December 1, 2025 Android Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (Android Security Bulletin).

The root cause is classified as CWE-125 (Out-of-bounds Read), specifically in the appendFrom function within Parcel.cpp in Android's native frameworks layer (frameworks/native). A missing bounds check allows a low-privileged local attacker to read beyond the intended memory boundary, which can be leveraged to escalate privileges on the device. No user interaction is required, and no additional execution privileges beyond a standard low-privilege user account are needed for exploitation. The fix is available in the Android open-source repository (Android AOSP Patch, Android Security Bulletin).

Successful exploitation allows a local attacker with low privileges to escalate to higher privilege levels on the affected Android device, resulting in high impact to confidentiality, integrity, and availability. An attacker could gain unauthorized access to sensitive system memory, potentially read protected data, modify system state, or execute actions beyond their authorized scope. The vulnerability is locally scoped (no network access required), but on a compromised or malicious-app-bearing device, it could serve as a stepping stone for deeper system compromise (Android Security Bulletin).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.005%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Android Security Bulletin).

Google has released a patch addressing CVE-2025-48596 in the December 1, 2025 Android Security Bulletin (security patch level 2025-12-01 or later). Users and administrators should apply the latest Android security update immediately. Device manufacturers (OEMs) such as Samsung and Huawei are expected to incorporate this patch into their own security updates. As a general workaround, restricting installation of untrusted applications reduces the attack surface for local privilege escalation vulnerabilities (Android Security Bulletin, Android AOSP Patch).

The vulnerability was noted in routine coverage of Google's December 2025 Android Security Bulletin, which addressed over 100 vulnerabilities. Security news outlets such as BeyondMachines and TheCyberThrone covered the bulletin broadly, and RedPacketSecurity flagged CVE-2025-48596 on social media. No significant independent researcher commentary or targeted media coverage specific to this CVE has been identified (Android Security Bulletin).