CVE-2025-22432

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22432

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.

References
Link Resource
https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79 Product Patch
https://source.android.com/security/bulletin/2025-12-01 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*
History

10 Dec 2025, 13:20

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-08 17:16

Updated : 2025-12-10 13:20

NVD link : CVE-2025-22432

Mitre link : CVE-2025-22432

CVE.ORG link : CVE-2025-22432

JSON object : View

Products Affected

google

CWE
CWE-20

Improper Input Validation