CVE-2025-48522 - In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code

Back Back to CVE browser

HIGH

In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code

Published Sep 4, 2025

7.8

HIGH

CVSS 3.1

EPSS 0.10%

Description

In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor Google Product Android Default
unaffected
- Version
  13
  Status
  affected
  Constraints
  -
- Version
  14
  Status
  affected
  Constraints
  -
- Version
  15
  Status
  affected
  Constraints
  -
- Version
  16
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google

Android

unaffected

Version	Status	Constraints
13	affected	-
14	affected	-
15	affected	-
16	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-693

References (2)

Link	Providers	Tags
https://android.googlesource.com/platform/frameworks/base/+/bdad29b85a6ca7c55a697e4e66356b744ef6cdb9		Product
https://source.android.com/security/bulletin/2025-09-01		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner google_android

Published Sep 4, 2025

Updated Feb 26, 2026

Reserved May 22, 2025

Link CVE-2025-48522

CISA Vulnrichment

Updated Sep 6, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-48522

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-48522