CVE-2025-0079: Google Android Privilege Escalation Flaw

CVE-2025-0079 Overview

CVE-2025-0079 is a logic error in the Android Bluetooth module that can leave Audio/Video Distribution Transport Protocol (AVDTP) and Audio/Video Control Transport Protocol (AVCTP) channels unencrypted. The flaw affects multiple locations in the Bluetooth stack across Android 12 through Android 15. A local attacker with user execution privileges can leverage the missing encryption enforcement to escalate privileges on the device. Exploitation does not require user interaction. Google addressed the issue in the March 2025 Android Security Bulletin.

Critical Impact
A local application with limited privileges can exploit unencrypted Bluetooth media channels to achieve local privilege escalation with high impact on confidentiality, integrity, and availability.

Affected Products

Google Android 12.0 and 12.1
Google Android 13.0 and 14.0
Google Android 15.0

Discovery Timeline

2025-08-26 - CVE-2025-0079 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0079

Vulnerability Analysis

The vulnerability resides in the Android Bluetooth module and is classified under [CWE-250: Execution with Unnecessary Privileges]. AVDTP carries streaming audio and video payloads between Bluetooth devices, while AVCTP transports control commands such as remote control signalling. Both protocols are expected to run over encrypted L2CAP channels once Secure Simple Pairing has completed.

The flaw is a logic error that allows those channels to operate without the encryption enforcement the specification requires. As a result, media and control traffic that should be confidentiality-protected can traverse the local Bluetooth interface in cleartext. A local application that can interact with the Bluetooth stack can leverage this state to reach privileged code paths and escalate its permissions on the device.

Root Cause

The root cause is an incorrect conditional check that governs whether AVDTP and AVCTP L2CAP channels require link-layer encryption before accepting data. When the check evaluates incorrectly, the stack proceeds without enforcing encryption on the connection, exposing sensitive protocol handlers to unauthenticated input. The upstream fix is committed in the Android Bluetooth module at revision b1e6d8d1e393d246a0738c92747a0bef98e67a30 (see the Android Bluetooth Module Update).

Attack Vector

The attack vector is local. An attacker needs an application running with normal user execution privileges on the target device. No user interaction is required. By interacting with the exposed AVDTP or AVCTP channels while encryption is not enforced, the attacker can influence how paired-device traffic is processed by privileged Bluetooth components and gain elevated privileges within the Android security model.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Verified exploit code is not published; refer to the Android Security Bulletin March 2025 for vendor-supplied technical detail.

Detection Methods for CVE-2025-0079

Indicators of Compromise

Unexpected pairing or connection events to AVDTP (PSM 0x0019) or AVCTP (PSM 0x0017) endpoints without a corresponding encryption change event in the host controller interface (HCI) log.
Applications requesting Bluetooth permissions and initiating A2DP or AVRCP profile connections outside of expected user workflows.
Devices reporting Android security patch levels older than 2025-03-01 while actively used in sensitive environments.

Detection Strategies

Inspect Bluetooth HCI snoop logs on managed devices to confirm that Encryption Change events precede AVDTP and AVCTP data transfer.
Use mobile device management (MDM) inventory data to identify Android endpoints running versions 12.0 through 15.0 without the March 2025 patch level.
Baseline installed applications that hold BLUETOOTH_CONNECT and flag newly installed apps that request the permission without a clear media use case.

Monitoring Recommendations

Enroll Android endpoints in an MDM that reports security patch level and blocks noncompliant devices from corporate resources.
Forward mobile telemetry and application inventory to a centralized data lake so analysts can correlate Bluetooth activity with patch state.
Alert on downgrades or stalls in patch level for fleet devices that previously reported a March 2025 or later Android security patch.

How to Mitigate CVE-2025-0079

Immediate Actions Required

Apply the Android security patch level 2025-03-01 or later to all managed Android 12, 13, 14, and 15 devices.
Prioritize patch deployment for devices used by executives, developers, and other high-value users who frequently pair Bluetooth peripherals.
Audit installed applications and remove untrusted apps holding Bluetooth-related runtime permissions.

Patch Information

Google released the fix as part of the Android Security Bulletin March 2025. The corresponding source change is available in the Android Bluetooth Module Update. Device vendors ship the fix through OEM firmware updates aligned to the March 2025 patch level; verify the effective patch level on each device under Settings, About phone, Android security update.

Workarounds

Disable Bluetooth on devices that cannot be patched immediately, especially in high-risk environments.
Restrict pairing to trusted peripherals and remove unused paired devices from the Bluetooth cache.
Enforce MDM policies that block installation of untrusted applications and require the March 2025 or later security patch level for network access.

bash

# Check the Android security patch level on a connected device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for a patched device: 2025-03-01 or later