CVE-2025-48648: Android NotificationManagerService Resource Exhaustion DoS

Technical summary

The vulnerability exists in the isSameApp method of NotificationManagerService.java on Android. It stems from improper resource management (CWE-400) that permits an authenticated local process to exhaust memory or other system resources through repeated or specially crafted requests. The flaw does not require elevated privileges or user interaction, making it a straightforward local attack vector. The resulting denial of service persists until the affected service is restarted or the device is rebooted.

Business impact

This vulnerability can degrade user experience across any organization deploying Android devices, as affected users lose notification delivery capability—a critical mechanism for alerts, communications, and app functionality. In enterprise environments, this may delay critical notifications (security alerts, system warnings, calendar updates) and could be weaponized by malware or a local attacker to suppress security-related notifications, creating a secondary risk window.

Affected systems

Google Android is affected. Consult the official Android Security & Privacy Year in Review and vendor advisories for specific version numbers and patch availability, as those details are not provided in this source data.

Exploitability

Exploitability is moderate and localized. An attacker must already have local access to the device (as a regular user or application), but no additional privileges or social engineering is required. The lack of user interaction requirement means an installed app or a local user can trigger the flaw silently and repeatedly. However, the attack is confined to local impact and does not enable remote code execution or privilege escalation.

Remediation

Apply the available security patch from Google as soon as it is released and validated by your organization. For Android devices, this typically arrives through monthly security updates. Restrict installation of untrusted applications, as a malicious app with basic permissions could exploit this vulnerability. Enable device management policies to enforce timely patching across your fleet.

Patch guidance

Monitor Google's Android Security & Privacy page for the official patch release date and affected version ranges. Patches are typically rolled out through monthly security bulletins. Verify compatibility with your organization's Android deployment before rolling out updates to production devices. Test on a small subset of devices first to ensure no compatibility issues with dependent services or applications.

Detection guidance

Monitor system logs for unexpected NotificationManagerService restarts or crashes, which may indicate exploitation attempts. Watch for repeated resource spikes or memory exhaustion events on affected devices. Endpoint Detection and Response (EDR) tools configured for Android should flag suspicious process behavior targeting system services. Additionally, correlate logs from apps with unusual permission profiles requesting notification access or system-level privileges.

Why prioritize this

While the CVSS score of 5.5 (MEDIUM) reflects the local-only attack vector, the ease of exploitation and the complete loss of notification functionality warrant prompt patching. Organizations should prioritize this remediation to restore service resilience and prevent potential chaining with other vulnerabilities that might suppress security alerts.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H results in a score of 5.5 (MEDIUM). The score reflects: Local attack vector (AV:L) and low attack complexity (AC:L) reduce friction for a local attacker; low privileges required (PR:L) and no user interaction (UI:N) make exploitation straightforward; however, the impact is limited to availability (A:H) with no confidentiality or integrity compromise, and the scope is unchanged (S:U). The absence of a ransomware or active exploitation designation further supports the MEDIUM rating.

Frequently asked questions