Permissions Bypass in CarrierConfigLoader of Android Products

CVE-2025-48617

What is CVE-2025-48617?

A permissions bypass vulnerability exists in the CarrierConfigLoader component of Android, specifically within the overrideConfig method. This flaw could allow an attacker to circumvent user identifier checks, resulting in local escalation of privileges without requiring any additional execution permissions or user interaction. This type of vulnerability poses significant security risks, potentially enabling unauthorized actions that compromise the device's integrity and user data.

References