Critical Zero-Click RCE Vulnerability (CVE-2025-48593) in Android System Component
Google released a security update in November 2025 to address a critical remote code execution vulnerability, CVE-2025-48593, in the Android System component. This flaw allows attackers to execute code remotely on affected devices running Android versions 13 through 16 without requiring user interaction or additional execution privileges. The vulnerability stems from insufficient validation of user input, making it possible for exploitation via a zero-click attack vector.
The update also addressed a separate privilege escalation issue, CVE-2025-48581, affecting Android 16, but the primary concern is the zero-click RCE, which requires immediate patching due to its severity. Google has stated that there is no evidence of active exploitation in the wild at the time of the update. Security experts urge all users and organizations to apply the November 2025 security patch promptly to mitigate the risk posed by this critical vulnerability.
Sources
Related Stories
Android December 2025 Security Update Addresses Critical DoS and Two Exploited Zero-Days
Google released the December 2025 Android Security Bulletin, patching 107 vulnerabilities, including a critical remote Denial of Service (DoS) flaw (CVE-2025-48631) in the Android Framework and two zero-day vulnerabilities (CVE-2025-48633 and CVE-2025-48572) that are reportedly under active exploitation. The zero-days allow for information disclosure and elevation of privilege, affecting Android versions 13 through 16, and are believed to be targeted in limited attacks. The DoS vulnerability enables remote attackers to crash or disable devices without requiring user interaction or additional execution privileges. The update is distributed in two patch levels (2025-12-01 and 2025-12-05), covering both core Android components and vendor-specific issues. Google’s disclosure highlights the ongoing threat posed by actively exploited vulnerabilities in the Android ecosystem and underscores the importance of timely patching by device manufacturers and users. The December update represents one of the largest patch releases of the year, following a period of irregular vulnerability reporting from Google.
3 months agoZero-Click Remote Code Execution Vulnerability in Dolby Audio Decoder
A critical zero-click remote code execution (RCE) vulnerability has been discovered in the Dolby Unified Decoder, a widely used audio format processing component present in Android, iOS, and macOS devices. The flaw, tracked as CVE-2025-54957, is a high-severity out-of-bounds write issue that can be exploited by threat actors through maliciously crafted audio messages. According to Google Project Zero researchers Ivan Fratric and Natalie Silvanovich, the vulnerability arises from improper handling of evolution data within the decoder. Specifically, the decoder writes evolution information into a large, heap-like buffer, but a flaw in the length calculation due to integer wrap can result in overwriting later members of the struct, including critical pointers. This memory corruption can be triggered without any user interaction, making it a zero-click attack vector, particularly on Android devices. The vulnerability allows attackers to execute arbitrary code remotely, posing a significant risk to affected systems. Google has responded by releasing patches for ChromeOS to address the issue, demonstrating the cross-platform impact of the vulnerability. Microsoft has also included a fix for the flaw in its latest Patch Tuesday updates, indicating that Windows systems utilizing the Dolby decoder may also be at risk. The vulnerability's zero-click nature means that users could be compromised simply by receiving a malicious audio file, without needing to open or interact with it. Security researchers emphasize the importance of promptly applying available patches to mitigate the risk of exploitation. The discovery highlights the ongoing challenges in securing complex multimedia processing components, which are often integrated into a wide range of consumer and enterprise devices. The flaw's technical details, including the specific buffer overflow mechanism and the potential for pointer overwrites, underscore the sophistication required to both discover and exploit such vulnerabilities. The coordinated disclosure and rapid patching efforts by Google and Microsoft reflect the seriousness of the threat. Organizations are advised to review their exposure to the Dolby Unified Decoder and ensure all relevant updates are applied. The incident serves as a reminder of the critical need for robust security testing in third-party components embedded within operating systems and applications. Ongoing monitoring for exploitation attempts is recommended, as threat actors may attempt to reverse-engineer the patches to develop working exploits. The vulnerability's impact across multiple platforms increases its attractiveness to attackers, making timely remediation essential for both individual users and enterprises.
4 months ago
Google March Android Security Bulletin Patches 129 Flaws Including Actively Exploited Qualcomm Display Zero-Day
Google released the March 2026 *Android Security Bulletin*, issuing fixes for **129 vulnerabilities** across the Android ecosystem and shipping two patch levels (`2026-03-01` and `2026-03-05`) to help OEMs stage platform and hardware-specific updates. The most urgent issue is **CVE-2026-21385**, a **high-severity, actively exploited** zero-day in an open-source **Qualcomm display** component used in Android devices with affected Qualcomm/Snapdragon chipsets. Reporting indicates CVE-2026-21385 is a **memory-corruption** flaw caused by an **integer overflow/wraparound** condition that can lead to memory corruption during allocation/alignment in display drivers; successful exploitation could enable device compromise (e.g., arbitrary code execution and/or privilege escalation) and bypass security boundaries. Google and Qualcomm both acknowledged **limited, targeted exploitation in the wild**, and one account attributes discovery/confirmation of exploitation to Google’s **Threat Analysis Group (TAG)**; devices not updated to at least patch level `2026-03-05` remain exposed, making rapid patch deployment and user update compliance the primary risk-reduction actions.
1 weeks ago