Google’s latest Android security update fixes two actively exploited flaws
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-47319 | Information disclosure while exposing internal TA-to-TA communication APIs to HLOS | 6.7 | <1% | ||
| CVE-2025-47372 | Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication | 8.4 | <1% | ||
CVE-2025-48572+1 related CVE | Local Privilege Escalation in Android Framework Under Active Exploitation | 7.8 group max | <1% | KEV | KEV |
CVE-2025-48623+3 related CVEs | In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation | 7.8 | <1% |
From the original article
1 min read at securityaffairs.com
Google’s latest Android security update fixes 107 flaws across multiple components, including two vulnerabilities actively exploited in the wild. Google’s new Android update patches 107 vulnerabilities, including two already exploited in the wild, across system, kernel, and major vendor components. December’s Android update offers two patch levels (12-01, 12-05) for faster fixes across devices.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.