November 2025: the bulletin, and what actually shipped
The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.
At a glance
| Major | CVEs for it | Fixed | Probable | No public code | Security tags this month |
|---|---|---|---|---|---|
| Android 14 | 1 | 1 | 0 | 0 | android-security-14.0.0_r23 |
| Android 15 | 1 | 1 | 0 | 0 | android-security-15.0.0_r11 |
| Android 16 | 1 | 1 | 0 | 0 | android-security-16.0.0_r1, android-security-16.0.0_r2 |
| Android 17 (pre-release, 17-next) | 0 | 0 | 0 | 0 | none |
The bulletin also has 0 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.
What this month's security tags add
Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.
android-security-14.0.0_r23 adds the fix for 1 CVE: CVE-2025-48593.
android-security-15.0.0_r11 adds the fix for 1 CVE: CVE-2025-48593.
android-security-16.0.0_r2 adds the fix for 1 CVE: CVE-2025-48593.
Announced, with no public code
None this month.
Public before it was announced
None this month.
Fixed, by a probable match
None this month.
Security fixes no advisory mentions
Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.
Android 14: 1 fix in android-security-14.0.0_r23
Show the list
Android 15: 1 fix in android-security-15.0.0_r11
Show the list
Android 16: 28 fixes in android-security-16.0.0_r1, android-security-16.0.0_r2
Show the list
Fix analysis AI-generated
For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.
- CVE-2025-48593 · platform/packages/modules/Bluetooth
bta_hf_client_cb_init now cancels any outstanding SDP service search and frees the HF client's discovery database (p_disc_db) before the control block is zeroed, instead of silently dropping the pointer.
Bulletin revisions
| Version | Date | Notes |
|---|---|---|
| 1.0 | November 3, 2025 | Bulletin Published |
| 1.1 | November 14, 2025 | Bulletin updated |
| 1.2 | April 17, 2026 | Updated Issue List |
- No change seen since tracking started (2026-09-30).
Method and limits
Fixes are found in the public android-security-* tags by the bug id in the
commit message, then Change-Id and patch id against the bulletin's commit, then two probable
matches checked by content. "No public code" means no fixing commit in the ingested tags of
that major, not proof that no fix exists anywhere. When none of the code the bulletin's
commit patches exists in a major (removed or reworked before its release), the CVE is shown
as "patched code absent" instead. Vendor closed-source components and the kernel are out of
scope.
Data for this page (JSON).