medium5.5

CVE-2025-48529

In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy.

Impact

In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Vendor	Product	Affected versions
Google	Android	Versions 13.0, 14.0, 15.0, 16.0

Weakness classification

CWE-441

References

NVD record
CVE.org record
https://android.googlesource.com/platform/frameworks/opt/telephony/+/e5cdca27526f5c2c358880538c7a15d8d5d5dd6d
https://source.android.com/security/bulletin/2025-09-01