Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 Android
CISA KEV · ACTIVELY EXPLOITED

CVE-2025-48543 — art

CVE-2025-48543 is a Use After Free vulnerability in platform/art. It is in CISA's Known Exploited Vulnerabilities catalog (added 2025-09-04) — treat it as actively exploited and patch now. A fix is available for platform/art — see the affected versions and patch details below.

Also known asA-421834866
Published
Updated
Affected
5 pkgs
Patched
5 / 5
Exploits
1 known
Exploitation data as of Oct 21, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2025-09-04. Federal agencies were required to remediate by 2025-09-25.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2025-48543.

EPSS Exploitation Probability

via FIRST.org ↗
0.6%probability of exploitation in next 30 days
Lower Risk+0.09%
Lower risk than most CVEs50th percentile — riskier than 50% of all scored CVEsHighest risk
0.00%0.38%0.76%1.13%0.3%0.3%0.5%0.5%0.6%Apr 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

5 pkgs affected
📦platform/art📦platform/art📦platform/art📦platform/art📦platform/art

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Android packages — download data is not available via public APIs for these ecosystems.

Description

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Packages

5 total 5 fixed
EcosystemPackageVulnerable rangeFix
📦Androidplatform/art≥ 16-next:0&&< 16-next:2025-09-0116-next:2025-09-01
📦Androidplatform/art≥ 15:0&&< 15:2025-09-0115:2025-09-01
📦Androidplatform/art≥ 16:0&&< 16:2025-09-0116:2025-09-01
📦Androidplatform/art≥ 13:0&&< 13:2025-09-0113:2025-09-01
📦Androidplatform/art≥ 14:0&&< 14:2025-09-0114:2025-09-01

Affected Products

1 product · 4 configurations
OS
androidgoogle
4 versions
13.014.015.016.0
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

gamesarchive/CVE-2025-48543

PoC exploit for CVE-2025-48543 in C++

⭐ 54🍴 12Aug 2026

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for platform/art, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update platform/art to 16-next:2025-09-01 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-48543 is resolved across your whole dependency graph.

  3. Workarounds

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Frequently Asked Questions

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
O3 Security · Impact-Aware SCA

Is CVE-2025-48543 in your dependencies?

Find it across Android, including transitive dependencies.

Scan my dependencies How O3 SCA works
Actively Exploited: CVE-2025-48543: art