CVE-2025-48645 AI-generated analysis

platform/frameworks/base, device admin (core/java/android/app/admin/DeviceAdminInfo.java)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Wraps the pm.getText() call in DeviceAdminInfo.loadDescription in a try/catch that converts an OutOfMemoryError into a NotFoundException, so an oversized device-admin description resource no longer propagates an Error to the caller.

Root cause

DeviceAdminInfo.loadDescription(PackageManager) called pm.getText(mActivityInfo.packageName, mActivityInfo.descriptionRes, mActivityInfo.applicationInfo) directly. The resource comes from the package that declares the device admin receiver. If loading it threw OutOfMemoryError, the method did not handle it and the Error propagated to the caller. The commit message describes this as a DoS caused by a maliciously large string injected into the Receiver's label, while the code changed is the description load. The bulletin rates the issue EoP, High.

How the fix works

• core/java/android/app/admin/DeviceAdminInfo.java:loadDescription: the existing pm.getText(...) call is now wrapped in try { ... } catch (OutOfMemoryError e) { throw new NotFoundException(); }. The method already declared throws NotFoundException, so callers that handle a missing description now handle this case through the same path.
• No other logic changes: the descriptionRes != 0 check and the trailing throw new NotFoundException() are unchanged. One file, 5 insertions and 1 deletion.

Completeness

• Covers only DeviceAdminInfo.loadDescription. It does not limit the size of the loaded text. It only catches the OutOfMemoryError after the load has been attempted.
• DeviceAdminInfo.loadLabel, which delegates to mActivityInfo.loadLabel(pm), is not touched by this commit.
• At android-security-14.0.0_r29 the file also contains a @hide loadDescriptionSafe(PackageManager) that trims the description to 1024 characters via ComponentInfo#loadDescription. That method is not part of this diff, and the material does not show whether it belongs to this CVE's fix set.
• Only OutOfMemoryError is caught. Other Errors or RuntimeExceptions from pm.getText are not handled here.

Behavior changes

• If loading the description resource throws OutOfMemoryError, loadDescription now throws NotFoundException instead of letting the OutOfMemoryError propagate. Callers see the same exception type as for a missing description.
• No API signature change: the method already declared throws NotFoundException.

Per major

• Android 14: same fix: platform/frameworks/base ecf88469d44f in android-security-14.0.0_r25; 5/5 patched lines present at android-security-14.0.0_r29.
• Android 15: same fix: platform/frameworks/base 42b92b39e52c in android-security-15.0.0_r13 (identical hunk, different line offset); 5/5 lines present at android-security-15.0.0_r17.
• Android 16: same fix: platform/frameworks/base cee45869c491 in android-security-16.0.0_r4 (identical hunk); 5/5 lines present at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin; the patched region (5/5 lines) is already present at android-security-17.0.0_r1.

Unknowns

• Which process the failure occurs in, and whether that process is privileged. The commit only describes a DoS from a large string, while the bulletin rates the issue EoP.
• Why the commit message refers to the Receiver's label when the change is to the description load.
• Whether the second Cherrypick-From commit (8102beb663e3...) corresponds to the loadDescriptionSafe addition seen at r29 or to something else. Only the try/catch hunk is shown.
• Test coverage: the commit says Test: manual and includes no automated test.

Back to March 2026 · Findings