VulnSocial

CVE-2025-48611Disclosure(google / android)

LOWCVSS 7.8 · HIGH

Signal is active with 7 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

google CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-120

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • android

Threat summary

  • 7 mentions across 1 observed day

What's happening

  • Technical details provided in 6 signals
  • Disclosure: 7 classified signals
  • 7 total mentions across 1 day

Affected systems

Vendors
google
Products
android

1 version affected across 1 product

Deep dive

Activity timeline7 mentions / 1d
02457Mentions · 2026-03-10: 7Technical Details · 2026-03-10: 603-10
Signal classification1 categories
Disclosure
7100.0%
Referenced assets9 URLs
Full discourse7 posts
  • dbugs@ptdbugs
    Disclosure

    CVE: CVE-2025-48611 Vendor: Google Product: Pixel CVSS: 10.0 Credits: Canyie(石松洲) of LSPosed Team Description: In DeviceId of http://DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2025-48611 • https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01 #dbugs_vuln

    Post summary

    CVE-2025-48611 is a newly disclosed high‑severity vulnerability in Google Pixel's DeviceId, where a missing bounds check allows local privilege escalation without user interaction. References to the vulnerability database and Google's security bulletin are provided.

    00001165
    554 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    The severity is increased for this new vulnerability affecting Google Android (CVE-2025-48611) https://vuldb.com/?id.350204

    Post summary

    The post announces that the severity of a new Android vulnerability (CVE-2025-48611) has increased, but provides no additional technical or mitigation details.

    00000146
    2.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2025-48611 In DeviceId of http://DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additi… https://www.cve.org/CVERecord?id=CVE-2025-48611 ----- Traducción: CVE-2025… http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2025-48611 as a local privilege escalation vulnerability caused by a missing bounds check, but it offers no exploit code, patches, or evidence of active exploitation.

    0000080
    57 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-48611 In DeviceId of http://DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additi… https://www.cve.org/CVERecord?id=CVE-2025-48611

    Post summary

    This brief note reports a potential local privilege escalation vulnerability in DeviceId.java due to a missing bounds check, indicating a new discovery without evidence of exploitation or mitigation.

    00000223
    56.7K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2025-48611 - Critical In DeviceId of http://DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privil... https://www.thehackerwire.com/vulnerability/CVE-2025-48611/ https://t.co/c6nbdrHHdC

    Post summary

    A new local privilege escalation vulnerability (CVE‑2025‑48611) in DeviceId.java, caused by a missing bounds check, has been disclosed by The Hacker Wire.

    0000092
    133 followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2025-48611: CRITICAL] Possible desync in http://DeviceId.java, leading to local privilege escalation without additional execution privileges. No user interaction needed for exploitation. #CyberSecurity#cve,CVE-2025-48611,#cybersecurity https://cvefind.com/CVE-2025-48611

    Post summary

    The post announces a critical CVE (CVE-2025-48611) that enables local privilege escalation via a desync flaw in DeviceId.java, requiring no user interaction.

    0000081
    601 followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2025-48611: Google (CVSS: 10.0)... Missing bounds check in http://DeviceId.java creates persistence desync leading to silent local privesc on all Pixels - zero-c... https://zerodaysignal.com/vulnerability/CVE-2025-48611 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    A new CVE‑2025‑48611 with CVSS 10.0 has been disclosed, describing a bounds‑check omission that enables silent local privilege escalation on Pixel devices.

    00000114
    142 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
OSgoogleandroid---

Explore more

Back to dashboardgoogle CVEsandroid vulnerabilities