CVE-2025-22432

Description

In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.

PUBLISHED Reserved 2025-01-06 | Published 2025-12-08 | Updated 2025-12-09 | Assigner google_android

Problem types

Elevation of privilege

Product status

References

android.googlesource.com/...eaa6a64348a1d0c821e8c7e98d741a79

source.android.com/security/bulletin/2025-12-01

cve.org (CVE-2025-22432)

nvd.nist.gov (CVE-2025-22432)

Download JSON