Security Digest · Jun 1, 2026 · Vulnerability · Mobile
Android CVE-2025-48595: Exploited Integer Overflow
Android 14-16 integer overflow under limited, targeted exploitation, fixed by a bundled SQLite update at patch level 2026-06-01. Check fleets for older levels.
Our verdict
Check exposure
Fixed at patch level 2026-06-01 more than four months ago; the work now is finding Android devices still below that level and updating or replacing them.
Who must act: Organizations with company-owned or BYOD Android 14, 15 or 16 devices that report a security patch level before 2026-06-01, or whose maker has stopped shipping updates.
Who can relax: Fleets where every Android device reports patch level 2026-06-01 or later, and organizations with no Android devices handling company data.
- Affected
- Android 14, 15, 16 and 16 QPR2 with a security patch level before 2026-06-01
Android 13 is not listed in the June 2026 bulletin, so its status is not stated - Fixed in
- Security patch level 2026-06-01 or later (2026-06-05 includes it)
GrapheneOS says it shipped the fix in its 2025092501 and 2025100300 releases - CVSS
- 8.4 (v3.1, CISA-ADP)
- EPSS
- 1.7% (percentile 77)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- High
What to do
- Pull the security patch level of every managed Android device from your MDM and list any below 2026-06-01.
- Set a compliance rule that blocks corporate access for devices below 2026-06-01.
- Push or prompt the update, starting with executives, admins and staff who travel.
- Replace devices whose maker no longer ships security updates, and do not assume Android 13 devices are safe.
- For Pixel fleets, also require 2026-09-05 or later for the separate modem bug CVE-2026-58704.
How to check if you are affected or compromised
- Run adb shell getprop ro.build.version.security_patch or read it in Settings; anything below 2026-06-01 was exposed.
- Google has published no indicators, attacker names or victim details as of Oct 23, 2026, so patch level is the main signal.
- For high-risk users whose phones stayed unpatched, escalate to a mobile forensics specialist rather than relying on checks on the device.
What happened#
On June 1, 2026, Google's June Android Security Bulletin said: "There are indications that CVE-2025-48595 may be under limited, targeted exploitation." The bulletin files it under Framework as a High-severity elevation of privilege bug in Android 14, 15, 16 and 16 QPR2. The CVE record says an integer overflow "in multiple locations" can lead to code execution and local privilege escalation, with no extra privileges and no user interaction. CISA's enrichment scores it CVSS 3.1 8.4 (local, no privileges required). CISA added it to the KEV catalog on June 2 with a June 5 deadline, only three days later. NVD lists CWE-190.
The code changes show where the bug lives. Every AOSP change linked for this CVE concerns Android's bundled SQLite. Two of them, including b11607e, install SQLite 3.44.5 and select it for the 25Q2 release line. Two more revert that because it "incurred a performance regression." The fifth copies the 3.44.5 source into the existing 3.44.3 directories. A commit note says the 25Q4 release already selects a newer SQLite. Google has not said which upstream SQLite bug this is, or how attackers reached it.
The fix existed long before the bulletin. GrapheneOS says SQLite 3.44.5 shipped the backport on July 24, 2025. It also says Google disclosed the CVE to phone makers in a security preview release near the end of September 2025, and that GrapheneOS shipped it in release 2025092501. The project argued that calling this a zero-day misreads how Android bulletins work. As of Oct 23, 2026, no attacker or victim has been named.
Who is affected#
Android 14, 15, 16 and 16 QPR2 devices with a patch level before 2026-06-01. The 2026-06-05 level includes the fix. Android 13 appeared in the December 2025 tables but is absent here, so its status is simply not stated. Some makers may have shipped the preview patch early, but the only reliable signal is a reported level of 2026-06-01 or later.
Do you really need to act?#
Treat it as a fleet check. The bug is local, so an attacker first needs code on the device. Help Net Security guessed at a malicious app, but Google gave no attack path. "Limited, targeted" points to a few chosen victims, not mass exploitation. Phones on current updates have been covered since June. The exposure is devices that update late or not at all.
This fix also does not cover later bugs. For Pixel phones, CISA added a separate modem bug, CVE-2026-58704, to KEV in September 2026. Google's Pixel bulletin fixes it at patch level 2026-09-05.
What to do now#
- Export every Android device's security patch level from your MDM and list anything below 2026-06-01.
- Block corporate access below 2026-06-01 with a compliance rule.
- Push or prompt the update, starting with high-risk users.
- Replace devices that no longer get updates. Do not assume Android 13 devices are safe.
How to tell if you were hit#
No indicators have been published. Check the level with adb shell getprop ro.build.version.security_patch; anything below 2026-06-01 was exposed. For a high-risk user whose phone stayed unpatched for months, use a mobile forensics specialist.
Timeline#
- — SQLite 3.44.5 ships the backport, per GrapheneOS.
- — Google gives phone makers the fix in a security preview release, per GrapheneOS.
- — Google authors the revert for a performance regression; the replacement change follows on Dec 15.
- — The June bulletin flags limited, targeted exploitation.
- — CISA adds the CVE to KEV.
- — The bulletin is revised to add AOSP links.
- — KEV remediation deadline.
Vulnerability records
- CVE-2025-48595 · KEV 2026-06-02 · In multiple locations, there is a possible way to achieve code execution due to an integer overflow.
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- Android — Android Security Bulletin, June 2026 source.android.com
- AOSP — build/release b11607e: Select sqlite 3.44.5 on ap3a android.googlesource.com
- AOSP — external/sqlite 1612b56: Revert "Install sqlite 3.44.5 source files" android.googlesource.com
- AOSP — external/sqlite aaebce3: Copy 25Q2 sqlite 3.44.5 into 3.44.3 directories android.googlesource.com
- CVE record — CVE-2025-48595 cve.org
- NVD — CVE-2025-48595 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2025-48595 cisa.gov
- GrapheneOS — Google disclosed CVE-2025-48595 to OEMs in a security preview release near the end of September 2025 grapheneos.social
- GrapheneOS — SQLite 3.44.5 was released with this backport on 2025-07-24 grapheneos.social
- Android — Android Security Bulletin, December 2025 source.android.com
- Android — Pixel Update Bulletin, September 2026 source.android.com