CVE-2019-2225

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When pairing with a Bluetooth device, it may be possible to pair a malicious device without any confirmation from the user, and that device may be able to interact with the phone. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-110433804

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-22265.5In device_class_to_int of device_class.cc, there is a possible out of bounds read due to improper casting. This could lead to local informat CVE-2019-22276.5In DeepCopy of btif_av.cc, there is a possible out of bounds read due to improper casting. This could lead to remote information disclosure CVE-2019-22285.5In array_find of array.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disc CVE-2019-22295.5In updateWidget of BaseWidgetProvider.java, there is a possible leak of user data due to a missing permission check. This could lead to loca CVE-2019-22307.5In nfcManager_routeAid and nfcManager_unrouteAid of NativeNfcManager.cpp, there is possible memory reuse due to a use after free. This could CVE-2019-22314.4In Blob::Blob of blob.cpp, there is a possible unencrypted master key due to improper input validation. This could lead to local information CVE-2019-22327.5In handleRun of TextLine.java, there is a possible application crash due to improper input validation. This could lead to remote denial of s CVE-2019-22336.8In getUserCount and getCount of UserSwitcherController.java, there is possible new user creation due to a logic error. This could lead to lo CVE-2019-22357.8Buffer overflow occurs when emulated RPMB is used due to sector size assumptions in the TA rollback protection logic. in Snapdragon Auto, Sn CVE-2019-22365.5Null pointer dereference during secure application termination using specific application ids. in Snapdragon Auto, Snapdragon Compute, Snapd CVE-2019-22375.5Failure in taking appropriate action to handle the error case If keypad gpio deactivation fails leads to silent failure scenario and subsequ CVE-2019-22387.8Lack of check of data type can lead to subsequent loop-expression potentially go negative and the condition will still evaluate to true lead