CVE-2025-48651: KMKeymasterApplet Information Disclosure

CVE-2025-48651 Overview

A vulnerability exists in the importWrappedKey function of KMKeymasterApplet.java on Android devices that allows unauthorized access to cryptographic keys due to improper input validation. This flaw enables local information disclosure without requiring any additional execution privileges or user interaction, making it a significant security concern for Android device users.

Critical Impact

Local attackers can exploit this improper input validation vulnerability to access restricted cryptographic keys, potentially compromising sensitive data protected by the Android Keystore system.

Affected Products

• Android devices utilizing the KMKeymasterApplet component
• Android systems with affected Keymaster implementations

Discovery Timeline

• April 6, 2026 - CVE-2025-48651 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-48651

Vulnerability Analysis

This vulnerability affects the Android Keymaster subsystem, specifically within the importWrappedKey function of KMKeymasterApplet.java. The Keymaster is a critical security component responsible for generating, storing, and managing cryptographic keys within the Android Trusted Execution Environment (TEE) or hardware security module.

The flaw stems from improper input validation during the key import process. When wrapped keys are imported into the Keymaster, the function fails to properly validate input parameters, allowing an attacker to bypass access restrictions that should protect sensitive cryptographic material. This vulnerability can be exploited locally without requiring elevated privileges or user interaction, making it particularly dangerous for compromised applications or malware present on the device.

Root Cause

The root cause lies in insufficient input validation within the importWrappedKey method of the KMKeymasterApplet.java class. The function does not properly sanitize or verify the parameters passed during the wrapped key import operation, allowing malformed or crafted input to bypass security checks that normally restrict access to cryptographic key material.

Attack Vector

An attacker with local access to an Android device can exploit this vulnerability by calling the importWrappedKey function with specially crafted parameters. The attack does not require any special permissions beyond what a normal application might have, and no user interaction is necessary for successful exploitation. The attacker could leverage this to:

1. Access cryptographic keys that should be restricted to specific applications
2. Extract sensitive key material from the Android Keystore
3. Compromise data protected by affected keys

The vulnerability exists within the Keymaster's key import workflow. When a wrapped key is imported, the validation logic fails to properly verify input boundaries and restrictions, allowing unauthorized access to protected key material. For technical details, see the Android Security Bulletin April 2026.

Detection Methods for CVE-2025-48651

Indicators of Compromise

• Unusual or unexpected calls to the Keymaster importWrappedKey API from unauthorized applications
• Anomalous access patterns to the Android Keystore service
• Applications attempting to access cryptographic keys outside their normal scope

Detection Strategies

• Monitor system logs for suspicious Keymaster API calls, particularly to importWrappedKey
• Implement application behavior analysis to detect attempts to access keys belonging to other applications
• Deploy endpoint detection solutions capable of monitoring Android Keystore interactions

Monitoring Recommendations

• Enable verbose logging for Keymaster operations during security assessments
• Monitor for applications making excessive or unusual Keystore API calls
• Implement behavioral analysis for detecting key access anomalies on managed devices

How to Mitigate CVE-2025-48651

Immediate Actions Required

• Apply the April 2026 Android Security Bulletin patches immediately
• Ensure all managed Android devices are enrolled in automatic security update programs
• Assess potentially affected devices for signs of exploitation
• Consider restricting installation of untrusted applications on sensitive devices

Patch Information

Google has addressed this vulnerability in the Android Security Bulletin April 2026. Device manufacturers and carriers should distribute this patch to affected devices. Users should ensure their devices are updated to the latest security patch level dated 2026-04-01 or later.

Workarounds

• Limit installation of applications from untrusted sources until patches are applied
• Use mobile device management (MDM) solutions to enforce security policies on affected devices
• Monitor for suspicious application behavior that may indicate exploitation attempts
• Consider using hardware-backed key attestation to verify key integrity where possible