{"id":"ASB-A-381885240", "published":"2025-12-01T00:00:00Z", "modified":"2026-04-10T16:16:18.068628499Z", "aliases":["CVE-2025-48583", "A-381885240"], "details":"In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2-next:0"}, {"fixed":"16-qpr2-next:2025-12-01"}]}], "versions":["16-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df"], "severity":"High", "spl":"2025-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["143619953344380945349808832383999587221", "286088482419454752897083668920640001028", "170858495998197863390290425140665273806", "110615400924175761923546864167627389257", "199891992987289089874250973339042272847", "108749806646176519988174016819229327407", "332360363119861887931150936650991658935", "174920013543140927271118897934018274379", "284292221036374919610912170287316426200", "214350779031284022919206397139237238953", "173746568786115240580331887774006254272", "2518371267182303715587143145828960760", "112835875679903889994993851412138680665", "50255930011592675186927123601724888890", "96855873368237677560094400731679834550", "142704835177258080254798267019474560819", "238204882528022809087318930772490743983", "145042412466049663842034692563728188068", "185453565943576272065608264474601783247", "290904611754225128135947127671502448015", "190122645023913448121459157689719092314", "25989062265017724637505550613762711282"], "threshold":0.9}, "id":"ASB-A-381885240-019555dc", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/BaseBundle.java"}}, {"deprecated":false, "digest":{"function_hash":"284473703658618539898650731140527865345", "length":671}, "id":"ASB-A-381885240-30e56d8e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/Parcel.java", "function":"recycle"}}, {"deprecated":false, "digest":{"line_hashes":["276403105727619370977907454966767100842", "90835928758325504502206226486271879416", "266439707727820777743736932449010458894", "208177590637606379406118141748126922086", "197417365152524084707194007660260456893", "208202833007587115966697612462513679461", "136635482043147512751793536099562546364", "65236846875928434332512998728998408481", "140543593771012306847280793686663577554", "148487913652039469187015729328764216376"], "threshold":0.9}, "id":"ASB-A-381885240-57793c5f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/Parcel.java"}}, {"deprecated":false, "digest":{"function_hash":"46006982700023270702211945646139599328", "length":236}, "id":"ASB-A-381885240-6845f0a4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"clear"}}, {"deprecated":false, "digest":{"function_hash":"7014720804021016047949783468580237037", "length":106}, "id":"ASB-A-381885240-7c6b7a3f", "match_only_versions":["16-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"recycleParcel"}}, {"deprecated":false, "digest":{"function_hash":"285475719585484225080224746270989837680", "length":158}, "id":"ASB-A-381885240-95203fb3", "match_only_versions":["16-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/Parcel.java", "function":"freeBuffer"}}, {"deprecated":false, "digest":{"function_hash":"200759266969230290661157772594372078853", "length":736}, "id":"ASB-A-381885240-9dab69cd", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"unwrapLazyValueFromMapLocked"}}, {"deprecated":false, "digest":{"function_hash":"260380739112932968784793290585938158310", "length":1385}, "id":"ASB-A-381885240-bf5ffa63", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/266bbcd030ff34d09a3adb226b9fc32184c3b7df", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"initializeFromParcelLocked"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2025-12-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9"], "severity":"High", "spl":"2025-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"46006982700023270702211945646139599328", "length":236}, "id":"ASB-A-381885240-49e5b5e2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"clear"}}, {"deprecated":false, "digest":{"line_hashes":["143619953344380945349808832383999587221", "286088482419454752897083668920640001028", "170858495998197863390290425140665273806", "110615400924175761923546864167627389257", "199891992987289089874250973339042272847", "108749806646176519988174016819229327407", "332360363119861887931150936650991658935", "174920013543140927271118897934018274379", "284292221036374919610912170287316426200", "214350779031284022919206397139237238953", "173746568786115240580331887774006254272", "2518371267182303715587143145828960760", "112835875679903889994993851412138680665", "50255930011592675186927123601724888890", "96855873368237677560094400731679834550", "142704835177258080254798267019474560819", "238204882528022809087318930772490743983", "145042412466049663842034692563728188068", "185453565943576272065608264474601783247", "290904611754225128135947127671502448015", "190122645023913448121459157689719092314", "25989062265017724637505550613762711282"], "threshold":0.9}, "id":"ASB-A-381885240-51b80ef6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/BaseBundle.java"}}, {"deprecated":false, "digest":{"function_hash":"337646080539226973219399309200324501582", "length":1393}, "id":"ASB-A-381885240-64b1c748", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"initializeFromParcelLocked"}}, {"deprecated":false, "digest":{"function_hash":"7014720804021016047949783468580237037", "length":106}, "id":"ASB-A-381885240-6bbd5b9a", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"recycleParcel"}}, {"deprecated":false, "digest":{"line_hashes":["80012019449043672887609934038642438131", "90835928758325504502206226486271879416", "266439707727820777743736932449010458894", "208177590637606379406118141748126922086", "197417365152524084707194007660260456893", "208202833007587115966697612462513679461", "136635482043147512751793536099562546364", "65236846875928434332512998728998408481", "140543593771012306847280793686663577554", "148487913652039469187015729328764216376"], "threshold":0.9}, "id":"ASB-A-381885240-6d127747", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/Parcel.java"}}, {"deprecated":false, "digest":{"function_hash":"200759266969230290661157772594372078853", "length":736}, "id":"ASB-A-381885240-9f403207", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"unwrapLazyValueFromMapLocked"}}, {"deprecated":false, "digest":{"function_hash":"285475719585484225080224746270989837680", "length":158}, "id":"ASB-A-381885240-e21e66df", "match_only_versions":["15"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/Parcel.java", "function":"freeBuffer"}}, {"deprecated":false, "digest":{"function_hash":"330302876922501969320285702144363611443", "length":624}, "id":"ASB-A-381885240-f86a8e87", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/728a21be645b3f9f5c0dcdd0b07168ad3d438fb9", "target":{"file":"core/java/android/os/Parcel.java", "function":"recycle"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2025-12-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b"], "severity":"High", "spl":"2025-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["143619953344380945349808832383999587221", "286088482419454752897083668920640001028", "170858495998197863390290425140665273806", "110615400924175761923546864167627389257", "199891992987289089874250973339042272847", "108749806646176519988174016819229327407", "332360363119861887931150936650991658935", "174920013543140927271118897934018274379", "284292221036374919610912170287316426200", "214350779031284022919206397139237238953", "173746568786115240580331887774006254272", "2518371267182303715587143145828960760", "112835875679903889994993851412138680665", "50255930011592675186927123601724888890", "96855873368237677560094400731679834550", "142704835177258080254798267019474560819", "238204882528022809087318930772490743983", "145042412466049663842034692563728188068", "185453565943576272065608264474601783247", "290904611754225128135947127671502448015", "190122645023913448121459157689719092314", "25989062265017724637505550613762711282"], "threshold":0.9}, "id":"ASB-A-381885240-18cd1d92", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/BaseBundle.java"}}, {"deprecated":false, "digest":{"function_hash":"200759266969230290661157772594372078853", "length":736}, "id":"ASB-A-381885240-32da1ea2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"unwrapLazyValueFromMapLocked"}}, {"deprecated":false, "digest":{"line_hashes":["276403105727619370977907454966767100842", "90835928758325504502206226486271879416", "266439707727820777743736932449010458894", "208177590637606379406118141748126922086", "197417365152524084707194007660260456893", "208202833007587115966697612462513679461", "136635482043147512751793536099562546364", "65236846875928434332512998728998408481", "140543593771012306847280793686663577554", "148487913652039469187015729328764216376"], "threshold":0.9}, "id":"ASB-A-381885240-43833c4a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/Parcel.java"}}, {"deprecated":false, "digest":{"function_hash":"260380739112932968784793290585938158310", "length":1385}, "id":"ASB-A-381885240-bb617986", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"initializeFromParcelLocked"}}, {"deprecated":false, "digest":{"function_hash":"7014720804021016047949783468580237037", "length":106}, "id":"ASB-A-381885240-bfb580ff", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"recycleParcel"}}, {"deprecated":false, "digest":{"function_hash":"285475719585484225080224746270989837680", "length":158}, "id":"ASB-A-381885240-c09c01cb", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/Parcel.java", "function":"freeBuffer"}}, {"deprecated":false, "digest":{"function_hash":"284473703658618539898650731140527865345", "length":671}, "id":"ASB-A-381885240-d834cb59", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/Parcel.java", "function":"recycle"}}, {"deprecated":false, "digest":{"function_hash":"46006982700023270702211945646139599328", "length":236}, "id":"ASB-A-381885240-e0445e21", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/d20f3599f89388d181735db351879d2487cc331b", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"clear"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2025-12-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237"], "severity":"High", "spl":"2025-12-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"46006982700023270702211945646139599328", "length":236}, "id":"ASB-A-381885240-0650f8df", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"clear"}}, {"deprecated":false, "digest":{"function_hash":"337646080539226973219399309200324501582", "length":1393}, "id":"ASB-A-381885240-09fd8713", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"initializeFromParcelLocked"}}, {"deprecated":false, "digest":{"line_hashes":["133025951392166269319845581268729694295", "12671139100329101586010429016059707143", "162299566821264737775330129930731748761", "191715323902013075878596258919932203361", "88697305904844850341107239285722538069", "210247925931020430629991040574406743056", "326795662881850518015248135513219353414", "332360363119861887931150936650991658935", "174920013543140927271118897934018274379", "284292221036374919610912170287316426200", "214350779031284022919206397139237238953", "173746568786115240580331887774006254272", "2518371267182303715587143145828960760", "112835875679903889994993851412138680665", "50255930011592675186927123601724888890", "96855873368237677560094400731679834550", "142704835177258080254798267019474560819", "238204882528022809087318930772490743983", "145042412466049663842034692563728188068", "185453565943576272065608264474601783247", "290904611754225128135947127671502448015", "190122645023913448121459157689719092314", "25989062265017724637505550613762711282"], "threshold":0.9}, "id":"ASB-A-381885240-1eb53a8b", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/BaseBundle.java"}}, {"deprecated":false, "digest":{"function_hash":"285475719585484225080224746270989837680", "length":158}, "id":"ASB-A-381885240-6a24dc90", "match_only_versions":["14"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/Parcel.java", "function":"freeBuffer"}}, {"deprecated":false, "digest":{"line_hashes":["80012019449043672887609934038642438131", "90835928758325504502206226486271879416", "266439707727820777743736932449010458894", "208177590637606379406118141748126922086", "197417365152524084707194007660260456893", "208202833007587115966697612462513679461", "136635482043147512751793536099562546364", "65236846875928434332512998728998408481", "140543593771012306847280793686663577554", "148487913652039469187015729328764216376"], "threshold":0.9}, "id":"ASB-A-381885240-ad8f260d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/Parcel.java"}}, {"deprecated":false, "digest":{"function_hash":"289686390697361430917964490623996917519", "length":818}, "id":"ASB-A-381885240-c0d25df3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"unwrapLazyValueFromMapLocked"}}, {"deprecated":false, "digest":{"function_hash":"330302876922501969320285702144363611443", "length":624}, "id":"ASB-A-381885240-c48983f6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/Parcel.java", "function":"recycle"}}, {"deprecated":false, "digest":{"function_hash":"7014720804021016047949783468580237037", "length":106}, "id":"ASB-A-381885240-f4dbdd35", "match_only_versions":["14"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/ba507647771b8a8c3481e192a1ba6c8027305237", "target":{"file":"core/java/android/os/BaseBundle.java", "function":"recycleParcel"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2025-12-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/02751bc65824a3877bdc21d865cd801b5e9f5e6c"}]}