CVE-2025-48651

1th percentile - higher than 1% of all known CVEs

In the importWrappedKey function in KMKeymasterApplet.java, there is a vulnerability that allows access to keys that should be restricted due to improper input validation. This could lead to local information disclosure without the need for additional execution privileges. User interaction is not required for exploitation.

The organization is at risk of leaking sensitive data stored in cryptographic keys, which could compromise information confidentiality. An attacker can access keys without any additional privileges, increasing the risk of local data disclosure.

Apply the patch provided by the operating system or device vendor immediately. In the meantime, restrict access to applications using Keymaster and monitor logs for suspicious activity.