Persistent Denial of Service in Android Device Policy Manager Service
CVE-2025-48554

6.1MEDIUM

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
4 September 2025

What is CVE-2025-48554?

The vulnerability arises in the handlePackagesChanged method of DevicePolicyManagerService.java, where a logic error may allow an attacker to create a persistent denial of service condition. This issue can be exploited locally, requiring user interaction, to disrupt device policies without needing additional execution privileges. Proper updates and patches are essential to mitigate this security risk.

Affected Version(s)

Android 16

Android 15

Android 14

References

https://android.googlesource.com/platform/frameworks/base...
https://source.android.com/security/bulletin/2025-09-01

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-48554 : Persistent Denial of Service in Android Device Policy Manager Service