Android Framework: Integer overflow leads to code execution and privilege escalation
Deadline for US federal agencies: 5 Jun 2026
Summary
An integer overflow in the Android Framework, present in multiple locations, can allow an attacker to execute code and escalate privileges locally. The attacker needs no additional execution privileges and no user interaction, but needs a foothold on the device, typically through a malicious app. Google reports indications of limited, targeted exploitation, and CISA lists the flaw as known exploited.
Affected
- Android 14
- Android 15
- Android 16
- Android 16-QPR2
Fixed in
- Security patch level 2026-06-05 or later (Android Security Bulletin June 2026)
- Exact AOSP fix commits and build numbers: Unknown.
- Availability depends on the device manufacturer's update rollout.
Workaround
- No vendor-specific workaround published.
- Restrict sideloading and allow app installation only from managed sources.
- Enable Google Play Protect scanning on managed devices.
Exploitation
- CISA added the CVE to the KEV catalog on 2026-06-02 (federal due date 2026-06-05).
- Google states there are indications of limited, targeted exploitation.
- Public proof of concept: none known.
- Ransomware use: Unknown.
Our recommendation
- Check the security patch level on all Android devices and require 2026-06-05 or later.
- Enforce MDM compliance and block non-compliant devices from corporate apps and data.
- Restrict sideloading and unknown app sources on managed devices.
- Replace devices that no longer receive security updates.
- Re-check the Google bulletin, as it may be updated.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (3 repositories)
HORKimhab/CVE-2025-48595 · fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow- · XiaoBaiLovesStirring/CVE-2025-48595-Exploit
Research sources
- Android Security Bulletin June 2026 source.android.com
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- NVD: CVE-2025-48595 nvd.nist.gov
- Help Net Security: Android vulnerability exploited (CVE-2025-48595) www.helpnetsecurity.com
- Canadian Centre for Cyber Security: Android security advisory June 2026 www.cyber.gc.ca
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:58.
Original description (NVD)
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.