{"id":"ASB-A-425662627", "published":"2025-12-01T00:00:00Z", "modified":"2026-04-03T15:37:31.002635057Z", "aliases":["CVE-2025-48584", "A-425662627"], "details":"In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2-next:0"}, {"fixed":"16-qpr2-next:2025-12-01"}]}], "versions":["16-qpr2-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5"], "severity":"High", "spl":"2025-12-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"234157392479211378466761526158057311704", "length":686}, "id":"ASB-A-425662627-25ff17b1", "match_only_versions":["16-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"handleOnPackageChanged"}}, {"deprecated":false, "digest":{"function_hash":"194161223105844991819985343020321659921", "length":854}, "id":"ASB-A-425662627-35923fc6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"writePolicyXml"}}, {"deprecated":false, "digest":{"function_hash":"236687273776736459921012597639754413833", "length":450}, "id":"ASB-A-425662627-564a92e4", "match_only_versions":["16-qpr2-next"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"verifyPrivilegedListener"}}, {"deprecated":false, "digest":{"function_hash":"230845005169053885051609618412741189710", "length":3870}, "id":"ASB-A-425662627-668f75a9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"dumpImpl"}}, {"deprecated":false, "digest":{"function_hash":"51441746281777270432991826738923173889", "length":2395}, "id":"ASB-A-425662627-9a198792", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"readPolicyXml"}}, {"deprecated":false, "digest":{"line_hashes":["135897995689547516737237041093398459449", "315583297743766064403846624255496421644", "29405189250986547264372506327246430113", "248386281050458130841695852976201213703", "6246270668136625667263304486828972794", "61704417962315293677064402596627918964", "275525267369431763447644155682396000832", "118131333017442368551233868361462706257", "160919767251381168083297441914984133205", "51249338142106732387578731125624804046", "308765082829924402664006223119980114742", "79184197438043920790041538467868314992", "321835745768518061969458498309778881578", "120493492971949544798728095518210738924", "193485692543348974723692229675222377056", "57690496347083817861931983046483405339", "321890763064572525593091080770616968447", "253111609355490117505618126483672602706", "132223446513184398529684134213997197102", "323988556313602404096970729079012055077", "69719909794668805257984661293177042133", "337908832011880663982781134489876166346", "21321185561142904723273672095743516100", "76601098041952395853029272204077707036", "273546519276946742867236508161841542350", "166631108232350128403885171794941088982", "5073060024208290118250435614712143650", "302542079501598894460537095162238162660", "38883391852170297788732782796914227811", "67545103514159469726136617047163561909", "54638990873883298797259168267593230732", "160874767781921076441051319796600415711", "1369961732512278772026676522092717654", "102376606943945088811267269929636996864", "302093233342329294811118101705222711546", "324929793847710292233519990170661256903", "247468369077076969332123355539916591511", "235991498533981192545553484633134625638", "336454789701125748341567265125528059441", "155533172812210934999856244558002337271", "283766130607990779691835984674849535740", "134522193208289409475764077329065961078", "322561520036952031065636078135668936537", "63467155925781295879605358474143372906", "58421842729245059654982645042670428159", "339114642993279899730468340492467598082", "196284760059804432855141295903114244641", "156463256223246381330264704958068571725", "269394482417875729206798185141141308154", "47993424825094646499213989689962774794", "12388781355726896604721928673155496117", "72710866419591529357307557042678401912", "171462002755766493021670502272282575843", "9825033146504705621527601067519516772", "323138023984174369172506553835522716798", "139977363228322583351830122794130331260", "184678809655267179201945324765719473223", "22301407107353183309674913959583939525", "121813856793007137905069713448844733541", "270688708793911316621425373886337141947", "72726235945082728170932274335277372375", "159076213996554715783557481413811683534", "199214615883718237785270177822812185647", "175026750667742199915631714688522293957", "177434955818358344592956625894641102730", "84948096829824679346122913859082908474", "134226139381065426882122098982281036398", "81462634743453177432493912645195300983", "216061055908474923009522425213533370485", "256481087164918290579263625397188400605", "111251792567390295708392436146538013635", "130501159583426063565927317597782085077", "34181740895323194935191489585816328269", "2269420210310684519317793485936761916"], "threshold":0.9}, "id":"ASB-A-425662627-b3fdf57c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"82638517559702168265842320378771425487", "length":3005}, "id":"ASB-A-425662627-ba3bf308", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"onStart"}}, {"deprecated":false, "digest":{"function_hash":"55061854829876695296635705178976216544", "length":9250}, "id":"ASB-A-425662627-e1c87534", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"init"}}, {"deprecated":false, "digest":{"function_hash":"23551821650618922045207646444283433796", "length":1022}, "id":"ASB-A-425662627-f9fe94fb", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/16b6836078042fc1b2288912e9656d01d9d20af5", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"createConversationNotificationChannelForPackageFromPrivilegedListener"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2025-12-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05"], "severity":"High", "spl":"2025-12-01", "types":["DoS"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"135596783293236406347658140469984563398", "length":3902}, "id":"ASB-A-425662627-63e7dc51", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"dumpImpl"}}, {"deprecated":false, "digest":{"function_hash":"42921360810459001151030940469014118579", "length":736}, "id":"ASB-A-425662627-8de63aae", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"createConversationNotificationChannelForPackageFromPrivilegedListener"}}, {"deprecated":false, "digest":{"function_hash":"194161223105844991819985343020321659921", "length":854}, "id":"ASB-A-425662627-9340d0ff", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"writePolicyXml"}}, {"deprecated":false, "digest":{"function_hash":"236687273776736459921012597639754413833", "length":450}, "id":"ASB-A-425662627-cc781f12", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"verifyPrivilegedListener"}}, {"deprecated":false, "digest":{"function_hash":"51441746281777270432991826738923173889", "length":2395}, "id":"ASB-A-425662627-dca5ad82", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"readPolicyXml"}}, {"deprecated":false, "digest":{"line_hashes":["135897995689547516737237041093398459449", "315583297743766064403846624255496421644", "29405189250986547264372506327246430113", "248386281050458130841695852976201213703", "6246270668136625667263304486828972794", "61704417962315293677064402596627918964", "275525267369431763447644155682396000832", "118131333017442368551233868361462706257", "160919767251381168083297441914984133205", "51249338142106732387578731125624804046", "308765082829924402664006223119980114742", "79184197438043920790041538467868314992", "323442239760031026575201511897767727028", "160234294633955345409021255675406467455", "13291824750132431422749821631835117311", "222976519158713685181886236704992935711", "321890763064572525593091080770616968447", "253111609355490117505618126483672602706", "132223446513184398529684134213997197102", "323988556313602404096970729079012055077", "152942684572397017710583860686318174106", "312798707272331405955179836554379373399", "314494733642689879143834171809681860791", "8675371721318526816699281374037052830", "273546519276946742867236508161841542350", "9207063480862443880321720692808695401", "247598298467561954723884588845967486314", "134349106886321940339019943351053682229", "54638990873883298797259168267593230732", "160874767781921076441051319796600415711", "1369961732512278772026676522092717654", "102376606943945088811267269929636996864", "302093233342329294811118101705222711546", "324929793847710292233519990170661256903", "247468369077076969332123355539916591511", "235991498533981192545553484633134625638", "336454789701125748341567265125528059441", "155533172812210934999856244558002337271", "283766130607990779691835984674849535740", "134522193208289409475764077329065961078", "322561520036952031065636078135668936537", "63467155925781295879605358474143372906", "58421842729245059654982645042670428159", "339114642993279899730468340492467598082", "196284760059804432855141295903114244641", "156463256223246381330264704958068571725", "269394482417875729206798185141141308154", "47993424825094646499213989689962774794", "12388781355726896604721928673155496117", "72710866419591529357307557042678401912", "171462002755766493021670502272282575843", "9825033146504705621527601067519516772", "323138023984174369172506553835522716798", "139977363228322583351830122794130331260", "184678809655267179201945324765719473223", "22301407107353183309674913959583939525", "121813856793007137905069713448844733541", "270688708793911316621425373886337141947", "72726235945082728170932274335277372375", "159076213996554715783557481413811683534", "199214615883718237785270177822812185647", "175026750667742199915631714688522293957", "177434955818358344592956625894641102730", "84948096829824679346122913859082908474", "134226139381065426882122098982281036398", "81462634743453177432493912645195300983", "216061055908474923009522425213533370485", "256481087164918290579263625397188400605", "111251792567390295708392436146538013635", "130501159583426063565927317597782085077", "34181740895323194935191489585816328269", "2269420210310684519317793485936761916"], "threshold":0.9}, "id":"ASB-A-425662627-de1da1a6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"223711100670863851982664216029820943180", "length":8999}, "id":"ASB-A-425662627-df08914e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"init"}}, {"deprecated":false, "digest":{"function_hash":"234157392479211378466761526158057311704", "length":686}, "id":"ASB-A-425662627-e608b2b5", "match_only_versions":["16"], "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"handleOnPackageChanged"}}, {"deprecated":false, "digest":{"function_hash":"322136027155435506284165115064793340624", "length":2886}, "id":"ASB-A-425662627-eacbd517", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/262f537110110e85eb0aaf27fbf6ee38a1659b05", "target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java", "function":"onStart"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2025-12-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/08a0766708db2071d9b8b65abf40d7e8057daaa1"}]}