EUVD-2025-210216Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on Android 17
-
DeliveryInvoke vulnerable provisioning API with crafted input
-
ExploitBypass input validation check
-
ExecutionGain elevated provisioning privileges
-
PersistDisable security controls and persist
-
ImpactExfiltrate data or pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to already have local code execution as a low-privileged app on an Android 17 device (PR:L, AV:L) - typically achieved by tricking the user into installing a malicious app or by chaining from a remote app-level RCE. No user interaction is required at the moment of privilege escalation (UI:N), and no specific non-default configuration is needed beyond running on an unpatched Android 17 build. Limiting factors: the bug is not remotely reachable on its own, requires the target to be on Android 17 specifically (not earlier major versions per EUVD), and exploitation paths through 'multiple locations' suggest the attacker may need to select the right provisioning entry point for the target's device state. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 and accurately reflects a high-impact local privilege escalation requiring only low privileges (any installed app) and no user interaction - a strong fit for chained mobile attacks where a malicious or compromised app pivots to system-level access. However, EPSS is very low (0.13%, 3rd percentile), the CVE is not on the CISA KEV list, and no public PoC is referenced, suggesting that real-world exploitation is not yet observed. The realistic prioritization is moderate-to-high for Android fleet operators (especially enterprise MDM deployments where provisioning bypass undermines work-profile boundaries), but not an emergency for individual users absent confirmed exploit code. Note: the description is sparse - Google's bulletins are typically terse - so the exact provisioning component remains unverified from public data alone. |
| Exploit ScenarioDerived | A user installs a malicious app from a sideloaded source or a compromised Play Store listing; the app invokes the vulnerable provisioning API with crafted input that bypasses validation, granting it device-owner-like configuration capabilities or system-level privileges. From there the attacker disables security controls, installs persistent payloads, or exfiltrates corporate data from a work profile - all without prompting the user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
Local privilege escalation in Google Android 17 stems from improper input validation across multiple code paths that allows a low-privileged app or local user to bypass provisioning controls and gain elevated privileges without user interaction. No public exploit identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects no observed exploitation activity, though the CVSS 7.8 reflects the high impact once preconditions are met.
RemediationAI
Patch available per vendor advisory: apply the Android 17 Security Patch Level published in the Android Security Bulletin at https://source.android.com/docs/security/bulletin/android-17, and on managed fleets enforce the corresponding SPL via MDM compliance policy. Because vendor firmware delivery varies by OEM, confirm device-specific patched builds with the manufacturer (Pixel, Samsung, etc.) and block enrollment of devices below the fixed SPL. As a compensating control until devices receive the patch, restrict installation of untrusted apps (Play Protect enforcement, disabling sideloading via MDM), and on enterprise deployments tighten work-profile provisioning policies - accepting the trade-off that stricter app-install policies reduce user flexibility and may break legitimate sideload workflows. See also https://vuldb.com/vuln/371848 for the third-party advisory tracker entry.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-20 (Improper Input Validation) within Android's provisioning subsystem, which governs device setup, work-profile/device-owner enrollment, and related configuration flows. Because the issue is described as occurring 'in multiple locations,' the underlying weakness is likely a shared input-validation routine or pattern reused across provisioning entry points rather than a single isolated bug. The affected CPE (cpe:2.3:a:google:android:*) and EUVD scope to Android 17 indicate the regression or weakness is tied to functionality introduced or modified in that platform release, fixed via the monthly Android Security Bulletin.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local app context required (AV:L, PR:L), no user interaction (UI:N), provisioning bypass yields full system-level control so C/I/A all High; scope unchanged within Android security model.
Primary rating from Vendor (google_android).
CVSS VectorVendor: google_android
Lifecycle Timeline
3DescriptionCVE.org
In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
Android 17 devices in your organization are vulnerable to local privilege escalation (CVE-2025-48643) that allows installed apps or local users to bypass provisioning controls and gain system access without user interaction. No public exploit identified at time of analysis, and no vendor patch is currently available, creating a significant security gap that requires immediate compensating controls for any Android 17 deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce MDM policies restricting app installation sources and runtime permissions; implement Android work profiles or containerization to prevent unprivileged app escalation; deploy endpoint detection and response (EDR) to alert on privilege escalation events; restrict physical device access and enforce full-disk encryption; maintain incident response procedures for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB