What is the CVSS score of CVE-2025-48617?

CVE-2025-48617 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Android are affected by CVE-2025-48617?

A local privilege escalation flaw in Google Android 17 (CVE-2025-48617) enables malicious applications to gain elevated control over device carrier configurations, potentially compromising the…

How to fix or mitigate CVE-2025-48617?

Within 24 hours, identify all Android 17 devices in your fleet and assess their criticality to business operations. Within 7 days, implement Mobile Device Management (MDM) controls to restrict app installation sources, monitor carrier configuration changes, and restrict privileged application installation where feasible. Within 30 days, develop and execute a migration plan to newer Android versions as patches become available; coordinate with device manufacturers and carriers for security updates, timelines, and patch status validation.

Android CVE-2025-48617

EUVD-2025-210214 HIGH

Missing Authorization (CWE-862)

2026-06-17 google_android

Authentication Bypass Privilege Escalation Google

7.8

CVSS 3.1 · Vendor: google_android

Severity by source

Vendor (google_android) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local malicious app foothold gives AV:L/PR:L, low-complexity missing-auth check gives AC:L, and unauthorized carrier config control yields total C/I/A impact within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (google_android).

CVSS VectorVendor: google_android

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:32 vuln.today

CVE Published

Jun 17, 2026 - 05:53 cve.org

HIGH 7.8

CVE Published

Jun 17, 2026 - 05:53 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Local privilege escalation in Google Android 17 arises in the overrideConfig method of CarrierConfigLoader.java, where a missing UID authorization check lets a low-privileged local application override carrier configuration it should not control. Exploitation requires no user interaction and grants total impact over confidentiality, integrity, and availability of the affected component, but there is no public exploit identified at time of analysis and CISA SSVC rates exploitation as none. EPSS is low (0.13%, 3rd percentile), consistent with a not-yet-exploited local flaw.

Technical ContextAI

CarrierConfigLoader is the Android telephony framework service responsible for loading and applying carrier-specific configuration (CarrierConfig bundles) that govern operator features such as VoLTE, roaming, emergency numbers, and various radio and UI behaviors. The overrideConfig API is intended to be callable only by privileged or carrier-authorized components, gated by a UID/caller identity check. The root cause is CWE-862 (Missing Authorization): the code fails to correctly validate the calling UID before honoring an override request, so a caller that lacks the required identity can still push configuration overrides. The CPE cpe:2.3:a:google:android identifies the affected component as the Android platform software itself rather than a specific OEM app.

RemediationAI

Patch available per vendor advisory: apply the Android security patch level that addresses CVE-2025-48617 as published in the Android Security Bulletin (https://source.android.com/docs/security/bulletin/android-17); on Pixel and OEM devices this means updating to the security patch level that lists this CVE as fixed. Because this is a platform framework fix, no reliable in-app workaround fully closes the missing UID check; compensating controls until patched include restricting installation of untrusted apps (the required local foothold) via managed/enterprise app allowlisting and Play Protect, and using MDM to enforce that only vetted apps can be sideloaded - the trade-off is reduced flexibility for users who install apps outside managed channels. Exact fixed version numbers should be taken from the bulletin rather than assumed.