CVEvulnerability

CVE-2025-22432

6.7 MEDIUM Published 2025-12-08 Modified 2026-10-07 Official page ↗

Status: Analyzed
Published: 2025-12-08
Last modified: 2026-10-07
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 6.7 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20

Description

In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.

Affected configurations

• google android 13.0 • google android 14.0 • google android 15.0 • google android 16.0

Weakness · CWE (1)

CWE-20 Improper Input Validation weakness

References

https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79 Patch, Product
https://source.android.com/security/bulletin/2025-12-01 Vendor Advisory

CVE-2025-22432

Description

Affected configurations

Related

Weakness · CWE (1)

References