CVE-2025-22404
Published: 26 August 2025
Summary
CVE-2025-22404 is a high-severity Use After Free (CWE-416) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the use-after-free vulnerability by requiring timely application of the vendor-provided patch referenced in the Android Security Bulletin.
Enforces memory safeguards such as randomization and execution prevention to block arbitrary code execution from the use-after-free flaw in the Bluetooth stack.
Vulnerability scanning identifies the CVE-2025-22404 use-after-free in the Android Bluetooth stack, enabling proactive flaw remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Bluetooth stack directly enables local arbitrary code execution for privilege escalation (T1068).
NVD Description
In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2025-22404 is a use-after-free vulnerability in the avct_lcb_msg_ind function of avct_lcb_act.cc, located in the Android Open Source Project's Bluetooth stack under platform/packages/modules/Bluetooth. Published on 2025-08-26, it carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-416. The flaw enables potential arbitrary code execution and affects Android devices with unpatched Bluetooth implementations.
A local attacker requires no privileges or user interaction to exploit this vulnerability with low attack complexity. Successful exploitation leads to local escalation of privilege, granting high-impact confidentiality, integrity, and availability compromises through arbitrary code execution.
The Android Security Bulletin for March 2025-03-01 addresses this issue, recommending users apply available security patches. A fix commit is available at https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c.
Details
- CWE(s)