CVE-2025-48631: Google Android DOS Vulnerability

CVE-2025-48631 Overview

CVE-2025-48631 is a resource exhaustion vulnerability in the Android operating system. The flaw resides in the onHeaderDecoded method of LocalImageResolver.java. An attacker can trigger a persistent denial of service condition without requiring user interaction. The vulnerability is tracked under [CWE-400] (Uncontrolled Resource Consumption).

Google disclosed the issue in the Android Security Bulletin for March 2026. Affected versions include Android 13, 14, 15, and 16, including several Android 16 QPR2 beta builds. No public proof-of-concept code or active exploitation has been reported.

Critical Impact

Remote attackers with low privileges can cause a persistent denial of service on affected Android devices by exploiting LocalImageResolver resource handling.

Affected Products

• Google Android 13.0
• Google Android 14.0 and 15.0
• Google Android 16.0 (including QPR2 Beta 1, 2, and 3)

Discovery Timeline

• 2025-12-08 - CVE CVE-2025-48631 published to NVD
• 2026-03-01 - Google publishes fix in Android Security Bulletin March 2026
• 2026-03-06 - Last updated in NVD database

Technical Details for CVE-2025-48631

Vulnerability Analysis

The vulnerability exists in the onHeaderDecoded callback of LocalImageResolver.java. This component is part of Android's image decoding pipeline. When an attacker supplies a malformed or malicious image, the decoder processes the header without enforcing resource limits. This leads to uncontrolled resource consumption on the device.

The condition results in a persistent denial of service. Persistent DoS implies that recovery may require user intervention beyond a simple process restart. The attack does not require user interaction. The attacker needs low privileges to deliver the malicious image payload to the vulnerable code path.

Root Cause

The root cause is missing bounds enforcement during image header processing inside onHeaderDecoded. The handler accepts attacker-controlled dimensions or metadata and allocates resources accordingly. Without sanity checks on the decoded header values, the allocation grows beyond safe limits. The system or application hosting the resolver exhausts memory or processing capacity.

Attack Vector

The attack vector is network-based but requires the attacker to deliver an image processable by LocalImageResolver. Delivery channels include messaging applications, shared content providers, or system components that render thumbnails. Once the image header is parsed, the resolver consumes excessive resources. Exploitation succeeds without execution privileges and without user action beyond receiving the content.

No verified exploitation code is publicly available. See the Android Security Bulletin March 2026 for vendor-supplied technical references.

Detection Methods for CVE-2025-48631

Indicators of Compromise

• Repeated crashes or unresponsiveness in Android system services that handle image rendering.
• Abnormal memory growth in processes invoking LocalImageResolver during image preview or thumbnail generation.
• Unexpected receipt of malformed image files via messaging or sharing intents preceding device instability.

Detection Strategies

• Monitor Android logcat entries for repeated LocalImageResolver exceptions and out-of-memory events.
• Inspect mobile threat defense telemetry for processes terminated by the low-memory killer in close proximity to image decoding activity.
• Correlate inbound messaging attachments with subsequent system instability across managed mobile fleets.

Monitoring Recommendations

• Track Android security patch level across enrolled devices using mobile device management (MDM) reporting.
• Alert on devices remaining on patch levels older than March 2026 after the rollout window.
• Review crash reports submitted through enterprise mobility platforms for image-handling stack traces.

How to Mitigate CVE-2025-48631

Immediate Actions Required

• Apply the March 2026 Android security patch level (2026-03-01 or later) to all managed devices.
• Enforce minimum patch-level compliance policies through MDM and conditional access controls.
• Restrict installation of applications that automatically render untrusted images in the background.

Patch Information

Google addressed the vulnerability in the March 2026 Android Security Bulletin. Device manufacturers integrate the fix into their respective monthly security patch releases. Administrators should consult the Android Security Bulletin March 2026 and confirm vendor-specific availability for each device model in their fleet.

Workarounds

• Disable automatic media preview and download in messaging applications until the patch is applied.
• Block delivery of attachments from untrusted senders at the email or messaging gateway layer.
• Limit use of unpatched devices to non-sensitive workloads where service interruption is tolerable.

# Verify Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-03-01 or later