CVE-2025-0084

HIGH

Google Android Bluetooth HFP Use-After-Free - Remote Code Execution

Title source: llm
STIX 2.1

Description

In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0115
EPSS Percentile 78.7%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-416
Status published
Products (3)
google/android 13.0
google/android 14.0
google/android 15.0
Published Aug 26, 2025
Tracked Since Feb 18, 2026