CVE-2025-48593

criticalpriority · track · 10EPSS 0.009 · 59 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

4 exploits · PoC

Likely / severe?

0.87% (59th) EPSS

CVSS 9.8 · critical

Is it mine?

22 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.6–9.8

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.1 · impact 5.9

v3.17.6highCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-416US

exploits (4)

Public proof-of-concept and weaponised exploit code.

C0D331ng/Blackash-CVE-2025-48593CVE-2025-48593PoC · poc_in_github
logesh-GIT001/CVE-2025-48593"A single malicious packet can own your device." — Android Security Team, Nov 2025PoC · poc_in_github
ranasen-rat/CVE-2025-48593ranasen-rat/CVE-2025-48593PoC · poc_in_github
zhuowei/blueshrimpProof-of-concept for CVE-2025-48593PoC · poc_in_github

affected products (22)

Products and version ranges known to be affected.

Samsung Android 13 <SMR-NOV-2025all versionscert_bundDE
Samsung Android 14 <SMR-NOV-2025all versionscert_bundDE
Samsung Android 15 <SMR-NOV-2025all versionscert_bundDE
Samsung Android 16 <SMR-NOV-2025all versionscert_bundDE
Samsung Android≤ 16 <SMR-NOV-2025cert_bundDE
Samsung Android≤ 13 <SMR-NOV-2025cert_bundDE
Samsung Android≤ 14 <SMR-NOV-2025cert_bundDE
Samsung Android≤ 15 <SMR-NOV-2025cert_bundDE
Google Android≤ 16enisa_euvdEU
Google Android≤ 14enisa_euvdEU
Google Android≤ 13enisa_euvdEU
Google Android≤ 15enisa_euvdEU
Google Inc Android≤ 16fstec_bduRU
Google Inc Android≤ 15fstec_bduRU
Google Inc Android≤ 14fstec_bduRU
Google Inc Android≤ 13fstec_bduRU
Google Android≤ vers:unknown/*ncsc_nlNL
Samsung mobile≤ vers:unknown/*ncsc_nlNL
google android= 13.0nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*
google android= 14.0nvdUScpe:2.3:o:google:android:*:*:*:*:*:*:*:*

showing 20 of 22

advisories (4)

Vendor and ecosystem advisories describing this.

NCSC-2025-0353Kwetsbaarheden verholpen in Google Android en Samsung MobileNL2025-11-04csaf · ncsc_nlNL
Google heeft kwetsbaarheden verholpen in Android. Samsung heeft kwetsbaarheden verholpen in Samsung Mobile
WID-SEC-W-2025-2472Samsung Android: Mehrere SchwachstellenDeutsch2025-11-03csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Samsung Android ausnutzen, um möglicherweise beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
WID-SEC-W-2025-2474Android Patchday November 2025: Multiple VulnerabilitiesDeutsch2025-11-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen und beliebigen Code auszuführen.
ASB-A-3747469612025-11-01vendor · osvUS
In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2025-11-18modified 2026-09-26

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan