CVE-2025-48608

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Dec 8, 2025

CISA due date

—

The record

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected packages

Ecosystem	Package	Introduced	Fixed