CVE-2025-48571 Details
Description
In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
A logic error in the Bluetooth stack's security component (btm_sec.cc) allows for the interception of SMS messages, leading to unauthorized information disclosure. This vulnerability requires user interaction for exploitation.
Users can update their devices to Android 17 with a security patch level of 2026-07-01 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://source.android.com/docs/security/bulletin/android-17 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| google android | 17.0 - |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | New CVE Received | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |