CVE-2025-48595 is an integer overflow (CWE-190) in the Android Framework, present in multiple locations, that can be triggered by code already running locally on the device with no additional execution privileges and no user interaction required. A local attacker, such as a malicious or compromised app, who triggers the overflow can achieve code execution with elevated privileges, yielding a local escalation of privilege with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.4, local attack vector). The flaw affects the Android Framework component of Google's Android operating system, so it applies broadly across the Android device ecosystem; specific affected version ranges were not published in the available data. Google fixed the flaw in its June 2026 Android security update, which patched 124 flaws overall, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-02, with news coverage confirming it is being actively exploited in the wild. No public proof-of-concept is known, but confirmed in-the-wild exploitation makes patching urgent.
What to do: Apply Google's June 2026 Android security update (or later) to all Android devices as soon as the OEM build is available, and verify the device's 'Android security patch level' reads June 2026 or later before treating it as remediated. US federal agencies must remediate within the BOD 22-01 timelines per the KEV listing. Because exploitation requires local code execution, prioritize devices on which users can install or run untrusted apps, and use MDM tooling to track patch compliance across managed fleets.
Affected
Google Android
—
Estimated exposure
masshundreds of millions of Android devices potentially exposed (news coverage reports millions of affected devices) — The Android Framework is a core component shipped on essentially every Android device in a multi-billion-device installed base, and coverage of this flaw describes it as affecting millions of devices, so exposure is conservatively…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CISA Known Exploited Vulnerability
Affected
Android Framework
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Google patched 110 Pixel flaws including CVE-2026-58704, a modem privilege-escalation zero-day under limited targeted exploitation.
Google's September 2026 Pixel security update fixes 110 vulnerabilities, including CVE-2026-58704, a high-severity zero-day in the Cellular Modem subcomponent that Google says is under limited, targeted exploitation. The improper-authorization flaw lets attackers with adjacent network access and basic privileges escalate privileges without user interaction. The bulletin also includes 12 remote code execution and 89 privilege escalation flaws rated critical or high severity.
Google's September Pixel update patches CVE-2026-58704, a high-severity cellular modem privilege escalation flaw showing signs of limited targeted exploitation.
Google disclosed CVE-2026-58704 (CVSS 8.0), a privilege escalation flaw in the Pixel Cellular Modem caused by a logic error permitting proximal/adjacent privilege escalation with no user interaction or extra privileges needed. Google acknowledged indications the flaw may be under limited, targeted exploitation but did not identify the threat actor. The September 2026 Pixel update fixes 109 additional flaws, including 46 critical-severity issues in components such as BigOcean, Bootloader, IMS, and Trusted Execution Environment, plus two high-severity kernel privilege escalation bugs (CVE-2026-56914, CVE-2026-58773). Security patch level 2026-09-05 or later resolves all identified flaws.