{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/system_server/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*","cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*","cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2025-48583"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Android (14.0, 15.0, 16.0)"],"_cs_severities":["high"],"_cs_tags":["android","use-after-free","vulnerability","system_server"],"_cs_type":"advisory","_cs_vendors":["Google"],"content_html":"\u003cp\u003eCVE-2025-48583 is a use-after-free (UAF) vulnerability within the Android \u003ccode\u003esystem_server\u003c/code\u003e process. The flaw originates from improper \u003ccode\u003eParcel\u003c/code\u003e recycling logic in \u003ccode\u003eBaseBundle.recycleParcel()\u003c/code\u003e. When \u003ccode\u003eNotificationManager.notify()\u003c/code\u003e is triggered, a \u003ccode\u003eParcel\u003c/code\u003e object may be returned to the \u003ccode\u003esOwnedPool\u003c/code\u003e while a \u003ccode\u003eLazyValue\u003c/code\u003e still holds a reference to it. An attacker can influence the heap and trigger the reuse of this memory, leading to potential Type Confusion or privilege escalation to UID 1000.\u003c/p\u003e\n\u003cp\u003eGoogle has provided a patch (commit \u003ccode\u003e02751bc6\u003c/code\u003e) that replaces the vulnerable \u003ccode\u003erecycleParcel()\u003c/code\u003e method with \u003ccode\u003eparcel.destroy()\u003c/code\u003e, which properly invalidates the native pointer and prevents the object from returning to the reusable pool.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker triggers \u003ccode\u003eNotificationManager.notify()\u003c/code\u003e with specially crafted bundles containing a mix of lazy and eager entries.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esystem_server\u003c/code\u003e parses the bundle, creating \u003ccode\u003eLazyValue\u003c/code\u003e shells that reference the internal \u003ccode\u003eParcel\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eBaseBundle.recycleParcel()\u003c/code\u003e is invoked, returning the \u003ccode\u003eParcel\u003c/code\u003e buffer to the \u003ccode\u003esOwnedPool\u003c/code\u003e while the \u003ccode\u003eLazyValue\u003c/code\u003e retains a dangling reference.\u003c/li\u003e\n\u003cli\u003eAttacker performs a heap spray to allocate memory that overwrites the recycled \u003ccode\u003eParcel\u003c/code\u003e buffer.\u003c/li\u003e\n\u003cli\u003eAttacker forces an unwrap operation on the \u003ccode\u003eLazyValue\u003c/code\u003e, causing it to read the attacker-controlled data from the overwritten buffer.\u003c/li\u003e\n\u003cli\u003eThe system encounters an anomaly or invalid state due to the manipulated data, providing a primitive for further exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for heap memory manipulation within the \u003ccode\u003esystem_server\u003c/code\u003e (UID 1000). While the provided Proof-of-Concept currently validates the lifecycle UAF anomaly (Level 1), it confirms the structural vulnerability in the AOSP \u003ccode\u003eBundleRecyclingTest.java\u003c/code\u003e suite. Theoretical impact includes Type Confusion and remote code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Android devices running versions 14.0, 15.0, and 16.0.\u003c/li\u003e\n\u003cli\u003eVerify if systems have received the security update containing commit \u003ccode\u003e02751bc6\u003c/code\u003e or the associated monthly security patch.\u003c/li\u003e\n\u003cli\u003eMonitor for anomalous application behavior involving the \u003ccode\u003eNotificationManager\u003c/code\u003e or \u003ccode\u003esystem_server\u003c/code\u003e process crashes associated with \u003ccode\u003eBadParcelableException\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUse the \u003ccode\u003ePatchDetector\u003c/code\u003e logic described in the PoC to audit pre-patch environments by verifying the existence of the \u003ccode\u003erecycleParcel\u003c/code\u003e method and the status of \u003ccode\u003eParcel.destroy()\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T06:19:16Z","date_published":"2026-11-09T06:19:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-android-cve-2025-48583/","summary":"A use-after-free vulnerability in the Android system_server allows potential heap memory manipulation and type confusion via the NotificationManager.notify() API.","title":"Google Android: Use-After-Free in BaseBundle Parcel recycling (CVE-2025-48583)","url":"https://feed.craftedsignal.io/briefs/2026-11-android-cve-2025-48583/"}],"language":"en","title":"CraftedSignal Threat Feed - System_server","version":"https://jsonfeed.org/version/1.1"}