Google fixed a critical remote code execution in Android
嗯，用户让我帮忙总结一篇文章，控制在一百个字以内，而且不需要特定的开头。首先，我需要仔细阅读文章内容，理解主要信息。 文章讲的是Google在2025年11月的Android更新中修复了两个漏洞，其中一个严重漏洞可能导致远程代码执行。这两个漏洞分别是CVE-2025-48593和CVE-2025-48581。前者影响了多个Android版本，后者则影响了版本16，并且不需要额外权限就能被利用。 接下来，我需要将这些信息浓缩到100字以内。要确保包含关键点：修复的时间、漏洞数量、漏洞类型、影响范围以及是否有已知攻击。 可能会这样组织句子：Google在2025年11月的更新中修复了两个系统组件漏洞，其中一个是严重的远程代码执行漏洞，无需用户交互即可利用。这些补丁适用于多个Android版本，目前未发现针对这些漏洞的攻击。 检查一下字数是否符合要求，并且语言是否简洁明了。确保没有遗漏重要信息，并且表达清晰。 </think> Google在2025年11月的Android更新中修复了两个系统组件漏洞，其中一个是严重的远程代码执行漏洞，无需用户交互即可利用。这些补丁适用于多个Android版本，目前未发现针对这些漏洞的攻击。 2025-11-4 18:20:18 Author: securityaffairs.com(查看原文) 阅读量:3 收藏

Google fixed a critical remote code execution in Android

Pierluigi Paganini November 04, 2025

Google’s November 2025 Android update fixes two flaws in the System component, including a critical remote code execution issue.

Google’s November 2025 Android security updates addressed two vulnerabilities impacting the System component.

The fixes are included in the 2025-11-01 security patch level, the only patch level released this month by the IT giant.

“The most severe vulnerability in this section could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.” reads the bulletin published by Google.

The two vulnerabilities are:

  • CVE-2025-48593: an insufficient validation of user input that could lead to remote code execution (RCE). The flaw impacts Android versions 13, 14, 15, and 16.
  • CVE-2025-48581: In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates through mainline installations due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. The flaw impacts Android version 16.

The company is not aware of attacks in the wild exploiting these vulnerabilities

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)


文章来源: https://securityaffairs.com/184208/security/google-fixed-a-critical-remote-code-execution-in-android.html
如有侵权请联系:admin#unsafe.sh