CVE-2025-22432

MediumCVSS 6.7/10Last modified Oct 7, 2026

Description

In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Google	Android	16; 15; 14; 13

References

https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79Patch, Product
https://source.android.com/security/bulletin/2025-12-01Vendor Advisory

Timeline

Published: Dec 8, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-224337.8In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Prof CVE-2025-224347.8In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lea CVE-2025-224359.8In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of CVE-2025-224368.4In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This co CVE-2025-224377.8In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in CVE-2025-224387.8In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privi CVE-2025-224397.3In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing per CVE-2025-22449.8A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unseriali CVE-2025-224417.3In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privile CVE-2025-224427.0In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created CVE-2025-224435.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.CVE-2025-224445.6Exposure of resource to wrong sphere in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an information disclosure. Sy