CVE-2025-22435

The bug lies in improper handling of data types (CWE-843 — type confusion) in the avdt_msg_ind function responsible for processing AVDT protocol messages (Audio/Video Distribution Transport). An attacker with a previously paired Bluetooth device can send a specially crafted message that causes memory corruption. Exploitation does not require any additional privileges on the attacker's side or user interaction from the victim.

A paired malicious Bluetooth device can gain elevated privileges on a vulnerable Android device (privilege escalation), which consequently may lead to full system takeover.

Security patches available from the manufacturer should be applied according to references — the fix was published as part of the Android Security Bulletin dated 2025-04-01 (commit efa5f4ef386a8947f4777840c5cefff389740e86 in the Bluetooth module). It is recommended to update the Android system to a version containing the security patch from the mentioned bulletin as soon as possible.

Google Android — versions indicated in the manufacturer's references (Android Security Bulletin dated 2025-04-01)