CVE-2025-22431

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
Sep 2, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-224326.7In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could leCVE-2025-224337.8In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work ProfCVE-2025-224347.8In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could leaCVE-2025-224359.8In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of CVE-2025-224368.4In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This coCVE-2025-224377.8In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in CVE-2025-224387.8In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of priviCVE-2025-224397.3In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing perCVE-2025-22449.8A vulnerability in the sendMailFromRemoteSource method in Emails.php  as used in Bitdefender GravityZone Console unsafely uses php unserialiCVE-2025-224417.3In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileCVE-2025-224427.0In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created CVE-2025-224435.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.
CVE-2025-22431: Medium severity, CVSS 5.5 | Vulnix