CVE-2025-48644: 
NixOS vulnerability analysis and mitigation

CVE-2025-48644 is a persistent denial of service vulnerability in Google Android caused by improper input validation in multiple system locations. It affects Android versions 14.0, 15.0, 16.0, and 16.0 QPR2 variants. The vulnerability was publicly disclosed on March 2, 2026, as part of Google's Android Security Bulletin 2026-03-01. It carries a CVSS v3.1 base score of 5.5 (Medium) (Google Android Bulletin, Red Hat CVE).

The root cause is classified as CWE-20 (Improper Input Validation) occurring in multiple locations within Android system services. An attacker with low-privileged local access can supply malformed or unexpected input to trigger a persistent denial of service condition, causing affected system services to crash or become unavailable. No additional execution privileges are required, and user interaction is not needed for exploitation. The attack vector is local, with low attack complexity (Google Android Bulletin).

Successful exploitation results in a persistent (permanent) denial of service affecting local Android system services, with a high availability impact and no confidentiality or integrity impact. A low-privileged local user can crash or render critical system services unavailable without any user interaction, potentially requiring a device reboot or factory reset to recover. The scope is limited to the affected device and does not enable lateral movement or data exfiltration (Google Android Bulletin, Red Hat CVE).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Google Android Bulletin).

Google has released a patch addressing this vulnerability in the Android Security Bulletin dated 2026-03-01, covering Android 14.0, 15.0, 16.0, and 16.0 QPR2. Device manufacturers including Samsung and Huawei have incorporated this patch into their respective March 2026 security updates. Users and administrators should apply the latest available security patch level (2026-03-01 or later) to affected devices as soon as possible. No configuration-based workaround is publicly documented (Google Android Bulletin).

The CIS (Center for Internet Security) issued an advisory noting multiple vulnerabilities in the March 2026 Android update, including CVE-2025-48644, highlighting the broader patch batch's significance (CIS Advisory). Security news outlets such as GBHackers covered the March 2026 Android security update, which addressed 129 flaws in total, contextualizing this CVE within a larger patch release (GBHackers). No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified.