---
id: CVE-2025-48559
title: >-
  In multiple functions of AppOpsService.java, there is a possible add a large
  amount of app ops due to improper input validation
summary: >-
  In multiple functions of AppOpsService.java, there is a possible add a large
  amount of app ops due to improper input validation. This could lead to local
  denial of service with no additional execution privileges needed. User
  interaction …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-20
vendor: google
product: android
affected:
  - android = 13.0
  - android = 14.0
  - android = 15.0
  - android = 16.0
published: '2025-09-04'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T23:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-48559'
references:
  - url: >-
      https://android.googlesource.com/platform/frameworks/base/+/7b88db4928f390cb7656dcc4a14fac2d645301a9
    label: security@android.com
  - url: 'https://source.android.com/security/bulletin/2025-09-01'
    label: security@android.com
tags:
  - nvd
epss: 0.0009
epssPercentile: 0.00429
ingestedAt: '2026-09-30T23:29:32.362Z'
---

## Overview

In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

## Affected

- `android = 13.0`
- `android = 14.0`
- `android = 15.0`
- `android = 16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.