CVE-2025-48631

CVSS 3.1: 6.5 medium
EPSS: <1%p39
Published: Dec 8, 2025 · Dec 8, 2025
Modified: Oct 7, 2026

Analyze CVE-2025-48631 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Vendors: google

Products: android

Weakness: CWE-400

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news

6 stories

Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited

The Hacker NewsMar 4, 04:27 UTC · Mar 4, 2026VulnerabilityExploitedCVE-2026-21385 CVE-2026-0006 CVE-2026-0047+82 · 1 read

Android devices hit by exploited Qualcomm flaw CVE-2026

Security AffairsMar 3, 10:03 UTC · Mar 3, 2026VulnerabilityExploitedCVE-2026-21385 CVE-2026-0006 CVE-2026-0047+84 · 3 reads

Android's March 2026 security patch fixes over 100 flaws, one under targeted exploitation

Help Net SecurityMar 3, 00:00 UTC · Mar 3, 2026VulnerabilityExploitedCVE-2026-21385 CVE-2026-0006 CVE-2025-48631+84 · 1 read

Google Patches 107 Android Flaws, Including Two Framework Bugs Exploited in the Wild

The Hacker NewsDec 3, 06:35 UTC · Dec 3, 2025Exploit / PoCExploitedCVE-2025-48633 CVE-2025-48572 CVE-2025-48631+28 · 1 read

Google Releases Patches for Zero

Infosecurity MagazineDec 2, 11:15 UTC · Dec 2, 2025VulnerabilityExploitedCVE-2025-48633 CVE-2025-48572 CVE-2025-486312 · 1 read

Google addresses 107 Android vulnerabilities, including two zero

CyberScoopDec 1, 22:17 UTC · Dec 1, 2025VulnerabilityExploitedCVE-2025-48633 CVE-2025-48572 CVE-2025-486312