CVE-2025-22432

MEDIUM

Android - Local Privilege Escalation via CallRedirectionProcessor Input Validation

Title source: llm

Description

In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.

References (2)

Core 2

Core References

Product, Patch

https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79

Vendor Advisory

https://source.android.com/security/bulletin/2025-12-01

Scores

CVSS v3 6.7

EPSS 0.0006

EPSS Percentile 17.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-20

Status published

Products (4)

google/android 13.0

google/android 14.0

google/android 15.0

google/android 16.0

Published Dec 08, 2025

Tracked Since Feb 18, 2026