CVE-2025-48595KEV · OVERDUE
Android Framework Integer Overflow Vulnerability
High · published June 1, 2026
Patch now
Confirmed exploited, and the score agrees
CVSS calls it high at 8.4. It is confirmed in active exploitation. It sits in the 77.2th percentile for exploit probability.
140
days past CISA
deadline
What it is
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
The record
Technical detail
- CVSS v3.1
- 8.4 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.01714 · 77.2th percentile
- Published
- 2026-06-01T21:14Z
- KEV added
- 2026-06-02 · due 2026-06-05
EPSS history
Timeline
02 JUN 00:00Z
Added to CISA KEV — remediate by Jun 5
kev
01 JUN 21:14Z
In multiple locations, there is a possible way to achieve code execution due to an integer overflow
cvelistv5