---
title: "Android CVE-2025-48595: Exploited Integer Overflow"
url: https://erroneo.us/security/briefs/android-cve-2025-48595-sqlite-integer-overflow/
description: "Android 14-16 integer overflow under limited, targeted exploitation, fixed by a bundled SQLite update at patch level 2026-06-01. Check fleets for older levels."
type: security-brief
section: "Security Digest"
date_published: 2026-06-01
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-48595"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Android CVE-2025-48595: Exploited Integer Overflow

**Verdict: Check exposure.** Fixed at patch level 2026-06-01 more than four months ago; the work now is finding Android devices still below that level and updating or replacing them.

- **Who must act:** Organizations with company-owned or BYOD Android 14, 15 or 16 devices that report a security patch level before 2026-06-01, or whose maker has stopped shipping updates.
- **Who can relax:** Fleets where every Android device reports patch level 2026-06-01 or later, and organizations with no Android devices handling company data.
- **Affected:** Android 14, 15, 16 and 16 QPR2 with a security patch level before 2026-06-01; Android 13 is not listed in the June 2026 bulletin, so its status is not stated
- **Fixed:** Security patch level 2026-06-01 or later (2026-06-05 includes it); GrapheneOS says it shipped the fix in its 2025092501 and 2025100300 releases
- **CVEs:** CVE-2025-48595
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Pull the security patch level of every managed Android device from your MDM and list any below 2026-06-01.
2. Set a compliance rule that blocks corporate access for devices below 2026-06-01.
3. Push or prompt the update, starting with executives, admins and staff who travel.
4. Replace devices whose maker no longer ships security updates, and do not assume Android 13 devices are safe.
5. For Pixel fleets, also require 2026-09-05 or later for the separate modem bug CVE-2026-58704.

### How to check if you are affected

- Run adb shell getprop ro.build.version.security_patch or read it in Settings; anything below 2026-06-01 was exposed.
- Google has published no indicators, attacker names or victim details as of Oct 23, 2026, so patch level is the main signal.
- For high-risk users whose phones stayed unpatched, escalate to a mobile forensics specialist rather than relying on checks on the device.

## What happened

On June 1, 2026, Google's [June Android Security Bulletin](https://source.android.com/docs/security/bulletin/2026/2026-06-01) said: "There are indications that CVE-2025-48595 may be under limited, targeted exploitation." The bulletin files it under Framework as a High-severity elevation of privilege bug in Android 14, 15, 16 and 16 QPR2. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-48595) says an integer overflow "in multiple locations" can lead to code execution and local privilege escalation, with no extra privileges and no user interaction. CISA's enrichment scores it CVSS 3.1 8.4 (local, no privileges required). CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595) on June 2 with a June 5 deadline, only three days later. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-48595) lists CWE-190.

The code changes show where the bug lives. Every AOSP change linked for this CVE concerns Android's bundled SQLite. Two of them, including [b11607e](https://android.googlesource.com/platform/build/release/+/b11607ea3ec7ab3183b558392850c842c582d2cc), install SQLite 3.44.5 and select it for the 25Q2 release line. Two more [revert that](https://android.googlesource.com/platform/external/sqlite/+/1612b56a5b4092f8256dfaa2096e9680d3f47f98) because it "incurred a performance regression." The fifth [copies the 3.44.5 source](https://android.googlesource.com/platform/external/sqlite/+/aaebce3d8fd545d05f16cc9a137f22da8cad52c8) into the existing 3.44.3 directories. A commit note says the 25Q4 release already selects a newer SQLite. Google has not said which upstream SQLite bug this is, or how attackers reached it.

The fix existed long before the bulletin. GrapheneOS says [SQLite 3.44.5 shipped the backport](https://grapheneos.social/@GrapheneOS/116681501156712831) on July 24, 2025. It also says Google [disclosed the CVE to phone makers](https://grapheneos.social/@GrapheneOS/116681412600621685) in a security preview release near the end of September 2025, and that GrapheneOS shipped it in release 2025092501. The project argued that calling this a zero-day misreads how Android bulletins work. As of Oct 23, 2026, no attacker or victim has been named.

## Who is affected

Android 14, 15, 16 and 16 QPR2 devices with a patch level before 2026-06-01. The 2026-06-05 level includes the fix. Android 13 appeared in the [December 2025 tables](https://source.android.com/docs/security/bulletin/2025-12-01) but is absent here, so its status is simply not stated. Some makers may have shipped the preview patch early, but the only reliable signal is a reported level of 2026-06-01 or later.

## Do you really need to act?

Treat it as a fleet check. The bug is local, so an attacker first needs code on the device. [Help Net Security](https://www.helpnetsecurity.com/2026/06/02/android-vulnerability-exploited-cve-2025-48595/) guessed at a malicious app, but Google gave no attack path. "Limited, targeted" points to a few chosen victims, not mass exploitation. Phones on current updates have been covered since June. The exposure is devices that update late or not at all.

This fix also does not cover later bugs. For Pixel phones, CISA added a separate modem bug, CVE-2026-58704, to KEV in September 2026. Google's [Pixel bulletin](https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01) fixes it at patch level 2026-09-05.

## What to do now

1. Export every Android device's security patch level from your MDM and list anything below 2026-06-01.
2. Block corporate access below 2026-06-01 with a compliance rule.
3. Push or prompt the update, starting with high-risk users.
4. Replace devices that no longer get updates. Do not assume Android 13 devices are safe.

## How to tell if you were hit

No indicators have been published. Check the level with `adb shell getprop ro.build.version.security_patch`; anything below 2026-06-01 was exposed. For a high-risk user whose phone stayed unpatched for months, use a mobile forensics specialist.

## Timeline

- Jul 24, 2025 — SQLite 3.44.5 ships the backport, per GrapheneOS.
- Late Sep 2025 — Google gives phone makers the fix in a security preview release, per GrapheneOS.
- Dec 12, 2025 — Google authors the revert for a performance regression; the replacement change follows on Dec 15.
- Jun 1, 2026 — The June bulletin flags limited, targeted exploitation.
- Jun 2, 2026 — CISA adds the CVE to KEV.
- Jun 3, 2026 — The bulletin is revised to add AOSP links.
- Jun 5, 2026 — KEV remediation deadline.

## Sources

1. [Android — Android Security Bulletin, June 2026](https://source.android.com/docs/security/bulletin/2026/2026-06-01)
2. [AOSP — build/release b11607e: Select sqlite 3.44.5 on ap3a](https://android.googlesource.com/platform/build/release/+/b11607ea3ec7ab3183b558392850c842c582d2cc)
3. [AOSP — external/sqlite 1612b56: Revert "Install sqlite 3.44.5 source files"](https://android.googlesource.com/platform/external/sqlite/+/1612b56a5b4092f8256dfaa2096e9680d3f47f98)
4. [AOSP — external/sqlite aaebce3: Copy 25Q2 sqlite 3.44.5 into 3.44.3 directories](https://android.googlesource.com/platform/external/sqlite/+/aaebce3d8fd545d05f16cc9a137f22da8cad52c8)
5. [CVE record — CVE-2025-48595](https://www.cve.org/CVERecord?id=CVE-2025-48595)
6. [NVD — CVE-2025-48595](https://nvd.nist.gov/vuln/detail/CVE-2025-48595)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-48595](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48595)
8. [GrapheneOS — Google disclosed CVE-2025-48595 to OEMs in a security preview release near the end of September 2025](https://grapheneos.social/@GrapheneOS/116681412600621685)
9. [GrapheneOS — SQLite 3.44.5 was released with this backport on 2025-07-24](https://grapheneos.social/@GrapheneOS/116681501156712831)
10. [Android — Android Security Bulletin, December 2025](https://source.android.com/docs/security/bulletin/2025-12-01)
11. [Android — Pixel Update Bulletin, September 2026](https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01)
12. [Help Net Security — Google fixes actively exploited Android vulnerability (CVE-2025-48595)](https://www.helpnetsecurity.com/2026/06/02/android-vulnerability-exploited-cve-2025-48595/)

---
Source page: https://erroneo.us/security/briefs/android-cve-2025-48595-sqlite-integer-overflow/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt