CVE-2025-48647

Description

In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

PUBLISHED Reserved 2025-05-22 | Published 2026-01-16 | Updated 2026-01-16 | Assigner google_android

Product status

Credits

Martijn Bogaard of Google finder

References

source.android.com/...ecurity/bulletin/pixel/2026/2026-01-01 vendor-advisory

cve.org (CVE-2025-48647)

nvd.nist.gov (CVE-2025-48647)

Download JSON