CVE-2025-22410
Published: 26 August 2025
Summary
CVE-2025-22410 is a high-severity Use After Free (CWE-416) vulnerability in Google Android. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely identification, reporting, and correction of flaws such as the use-after-free vulnerability in Android's Bluetooth module through patching.
SI-16 enforces memory protection mechanisms like address space randomization and non-executable memory to prevent arbitrary code execution from use-after-free errors.
SC-39 isolates Bluetooth processes to limit the scope and impact of privilege escalation resulting from exploitation of the use-after-free vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Bluetooth stack directly enables local arbitrary code execution leading to privilege escalation without privileges or user interaction.
NVD Description
In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Deeper analysisAI
CVE-2025-22410 is a use-after-free vulnerability (CWE-416) present in multiple locations within the Android platform's Bluetooth module, specifically in platform/packages/modules/Bluetooth. This flaw allows for the execution of arbitrary code and could lead to local escalation of privilege, with no additional execution privileges needed. The vulnerability was published on 2025-08-26 and carries a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A local attacker can exploit this vulnerability due to its low attack complexity, lack of prerequisite privileges, and absence of required user interaction. Upon successful exploitation, the attacker achieves local escalation of privilege, gaining high-impact confidentiality, integrity, and availability compromises on the affected Android device.
The Android Security Bulletin for March 2025 provides details on mitigation, available at https://source.android.com/security/bulletin/2025-03-01. The corresponding patch is implemented in the commit at https://android.googlesource.com/platform/packages/modules/Bluetooth/+/806774b1cf641e0c0e7df8024e327febf23d7d7c.
Details
- CWE(s)