CVE-2025-48612
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Dec 8, 2025
CISA due date
—
The record
In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Android | platform/packages/apps/Settings | 13:0 | 13:2025-12-01 |
| Android | platform/packages/apps/Settings | 14:0 | 14:2025-12-01 |
| Android | platform/packages/apps/Settings | 15:0 | 15:2025-12-01 |
| Android | platform/packages/apps/Settings | 16-qpr2-next:0 | 16-qpr2-next:2025-12-01 |
| Android | platform/packages/apps/Settings | 16:0 | 16:2025-12-01 |
Related vulnerabilities
- CVE-2025-48555 In multiple functions of NotificationStation.java, there is a possible cross-profile… Also affects platform/packages/apps/Settings
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20
- CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate… CWE-20
- CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with a fast… CWE-20
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-20