The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding two active Android zero-day vulnerabilities, adding them to its Known Exploited Vulnerabilities (KEV) catalog on December 2, 2025.
These security flaws, found within the Android Framework, are currently being exploited in the wild, prompting a federal mandate for immediate remediation by December 23, 2025.
Technical Analysis of the Vulnerabilities
The two vulnerabilities affect the core Android Framework, a critical layer of the operating system that manages application interactions and system resources.
- CVE-2025-48572 (Privilege Escalation): This high-severity vulnerability allows a local attacker to escalate privileges on a compromised device. By exploiting an unspecified flaw in the Framework, a malicious actor could gain elevated permissions potentially up to the
SYSTEMlevel without requiring user interaction. - This type of exploit is particularly dangerous as it allows attackers to bypass sandbox restrictions and gain persistence on the device.
- CVE-2025-48633 (Information Disclosure): This vulnerability enables attackers to access sensitive data that should be restricted.
- While information disclosure flaws are often considered less severe than remote code execution, they are frequently chained with privilege escalation exploits (like CVE-2025-48572) to map memory layouts or steal credentials necessary for a full device compromise.
CISA’s addition of these CVEs to the KEV catalog confirms that threat actors are actively leveraging them in attacks.
While the specific campaigns have not been attributed to a known ransomware group, the potential for data theft and device takeover makes patching critical.
Federal civilian executive branch (FCEB) agencies are required to apply vendor-provided patches by the December 23, 2025 deadline under Binding Operational Directive (BOD) 22-01.
Private organizations and individual users are strongly advised to check for system updates immediately.
If a security patch is not yet available from your device manufacturer, CISA recommends discontinuing the use of the product until mitigations are released.
The agency also noted a separate vulnerability affecting OpenPLC ScadaBR systems in the same update, highlighting a broad range of targets in this week’s security advisory.
| CVE ID | Vulnerability Name | Component | Impact | Due Date |
|---|---|---|---|---|
| CVE-2025-48572 | Android Framework Privilege Escalation | Android Framework | Allows local attackers to gain elevated system privileges. | 2025-12-23 |
| CVE-2025-48633 | Android Framework Information Disclosure | Android Framework | Allows unauthorized access to sensitive memory or data. | 2025-12-23 |
| Unspecified | OpenPLC ScadaBR Vulnerability | ScadaBR | Unspecified vulnerability in industrial automation software. | 2025-12-23 |
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=These security flaws, found within the Android Framework, are currently being exploited in the wild, prompting a federal mandate for immediate remediation by December 23, 2025.){kind=link}