Android Security Bulletin – September 2025 Patches Actively Exploited Flaws (CVE-2025-38352 & CVE-2025-48543) and Critical RCE

The Android Security Bulletin for September 2025 notes that devices running Android 10 and later with the 2025-09-05 patch level are protected against all identified threats.

It highlights two vulnerabilities under active exploitation: CVE-2025-38352 (CVSS 7.4), a Linux kernel race condition in posix-cpu-timers that could trigger kernel instability or denial of service under specific timing, and CVE-2025-48543 (High), a vulnerability in the Android Runtime that enables local privilege escalation with exploitation observed in the wild.

Beyond these, the bulletin patches several critical flaws, including CVE-2025-48539 (Critical, System) which could allow remote code execution with no user interaction within proximity, and multiple Qualcomm closed-source component vulnerabilities such as CVE-2025-21450, CVE-2025-21483, and CVE-2025-27034.

The bulletin also lists privilege escalation flaws in the Framework (e.g., CVE-2025-32324, CVE-2025-48552) and DoS issues in System components (e.g., CVE-2025-48550, CVE-2025-48559), with patches expected to be released to the Android Open Source Project within 48 hours, according to Google.