CVE-2025-48623CWE-20CWE-787

CVE-2025-48623

High · published December 8, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
1.1
In the wild
Unconfirmed
What it is

⚡ An out-of-bounds write in pkvm.c is like a construction crew building past the blueprints – if it goes unnoticed, it could lead to unauthorized access! Imagine a construction site where workers ignore the plans and start building extra floors. This could lead to structural weaknesses and safety concerns – in the cybersecurity world, that's what happens with improper input validation, allowing attackers to escalate privileges without needing a key! With this vulnerability, a local attacker can gain elevated privileges on the system, potentially allowing them to execute commands or access sensitive data with far greater authority than intended. This could be a serious breach of security, leading to unauthorized data manipulation or access!

Put simply

Imagine a construction site where workers ignore the plans and start building extra floors. This could lead to structural weaknesses and safety concerns – in the cybersecurity world, that's what happens with improper input validation, allowing attackers to escalate privileges without needing a key! CVE-2025-48623 involves an out-of-bounds write in the function init_pkvm_hyp_vcpu of pkvm.c, caused by improper input validation, which may allow a local attacker to escalate their privileges without needing any additional execution permissions.

What to do

With this vulnerability, a local attacker can gain elevated privileges on the system, potentially allowing them to execute commands or access sensitive data with far greater authority than intended. This could be a serious breach of security, leading to unauthorized data manipulation or access! To mitigate this vulnerability, ensure that the affected system is patched to the latest version where this issue is resolved. Review your input validation processes, and implement strict checks to prevent such out-of-bounds writes from occurring in the future. You've got this! Stay vigilant, apply those patches, and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00106 · 1.1th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-787 · Out-of-bounds Write
Published
2025-12-08T22:16Z
Affected products (1)
ProductVersionsFixed in
google/androidall versions—
References (3)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation
    cvelistv5