CVE-2025-48530 — Out-of-bounds Read in External Rust Crabbyavif

CWE-125 — Out-of-bounds Read5 documents5 sources

Severity

8.1HIGHNVD

EPSS

0.2%

top 59.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Platform External Rust Crabbyavif Google Android

Timeline

PublishedSep 4

Description

In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check. This could lead to remote code execution in combination with other bugs, with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶Androidplatform/external_rust_crabbyavif16-next:0 — 16-next:2025-08-01+1

▶CVEListV5google/android16

▶NVDgoogle/android16.0

🔴Vulnerability Details

GHSA

GHSA-cm4w-gmjc-w5mw: In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check↗2025-09-04

▶

CVEList

CVE-2025-48530: In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check↗2025-09-04

▶

OSV

CVE-2025-48530: In multiple locations, there is a possible condition that results in OOB accesses due to an incorrect bounds check↗2025-08-01

▶

📋Vendor Advisories

Android

CVE-2025-48530: Android Security Bulletin 2025-08-01 CVE: CVE-2025-48530 Severity: CRITICAL Type: RCE Affected AOSP versions: 16 References: A-419563680 [2]↗2025-08-01

▶