CVE-2025-22409
Published: 26 August 2025
Summary
CVE-2025-22409 is a high-severity Use After Free (CWE-416) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of identified flaws like the use-after-free in rfc_send_buf_uih, enabling patching of the vulnerable Bluetooth module code.
Implements memory protection mechanisms such as address space layout randomization and non-executable memory to mitigate arbitrary code execution from the use-after-free vulnerability.
Ensures receipt and implementation of security advisories and bulletins, such as the Android security bulletin providing the patch for CVE-2025-22409.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Android Bluetooth stack directly enables local arbitrary code execution for privilege escalation (T1068).
NVD Description
In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2025-22409 is a use-after-free vulnerability (CWE-416) in the rfc_send_buf_uih function of rfc_ts_frames.cc, located in the Android platform's Bluetooth module (packages/modules/Bluetooth). This flaw enables arbitrary code execution and has a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete confidentiality, integrity, and availability impacts.
A local attacker requires no additional execution privileges or user interaction to exploit the vulnerability. By triggering the use-after-free condition, the attacker can achieve local escalation of privilege through arbitrary code execution, potentially gaining higher-level access on the affected Android device.
Android's security bulletin (https://source.android.com/security/bulletin/2025-03-01) addresses the issue, with a specific patch available in the Bluetooth module commit at https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c. Mitigation involves applying this patch or updating to affected Android versions listed in the bulletin.
Details
- CWE(s)