CVE-2025-0084: Google Android RCE Vulnerability via Bluetooth

CVE-2025-0084 Overview

CVE-2025-0084 is a use-after-free vulnerability [CWE-416] in the Android Bluetooth stack that can lead to an out-of-bounds write. The flaw resides in the Hands-Free Profile (HFP) implementation and affects Android versions 13, 14, and 15. An attacker within Bluetooth range can trigger remote code execution when HFP support is enabled, without requiring additional privileges or user interaction. Google addressed the issue in the March 2025 Android Security Bulletin with patches to the Bluetooth module.

Critical Impact
Remote code execution over Bluetooth with no user interaction required, affecting Android 13, 14, and 15 devices with HFP enabled.

Affected Products

Google Android 13.0
Google Android 14.0
Google Android 15.0

Discovery Timeline

2025-08-26 - CVE-2025-0084 published to NVD
2025-09-02 - Last updated in NVD database

Technical Details for CVE-2025-0084

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Android Bluetooth module that produces a subsequent out-of-bounds write. The defect appears in multiple locations within the Hands-Free Profile (HFP) handling code. HFP is the Bluetooth profile that enables voice call control between a phone and accessories such as headsets and car infotainment systems.

An attacker positioned within Bluetooth radio range can reach the vulnerable code path without prior pairing privileges. Exploitation does not require any user interaction on the target device. Successful exploitation grants code execution in the context of the Bluetooth process, which holds significant system privileges on Android.

Root Cause

The root cause is an object lifetime management defect in HFP-related code paths. A reference to a Bluetooth object is retained and later dereferenced after the underlying memory has been freed. This dangling reference enables an attacker-controlled write outside the bounds of the intended allocation. Google's fix is committed to the Android Bluetooth module at commit 94c565214e3496fbaade9efed8be41d6425ba21e.

Attack Vector

The attack vector is adjacent network access over Bluetooth radio. An attacker within wireless range crafts malicious HFP protocol messages that drive the vulnerable code into the use-after-free condition. Because HFP is commonly enabled on Android devices that pair with audio peripherals or vehicles, the attack surface is broad. The vulnerability mechanism is described in the Android Bluetooth Module Update and the Android Security Bulletin March 2025.

Detection Methods for CVE-2025-0084

Indicators of Compromise

Unexpected crashes or restarts of the Bluetooth process (com.android.bluetooth) recorded in logcat or tombstone files.
Anomalous Bluetooth pairing or connection attempts from unknown devices in proximity to the target.
Memory corruption signatures in native crash dumps referencing HFP code paths.

Detection Strategies

Monitor Android device telemetry for repeated Bluetooth stack crashes, which can indicate failed or successful exploitation attempts.
Inspect kernel and userspace logs for SIGSEGV or SIGABRT signals originating from the Bluetooth daemon.
Correlate device proximity events with Bluetooth service anomalies in enterprise mobility management (EMM) consoles.

Monitoring Recommendations

Track Android patch level compliance across the fleet and flag devices below the March 2025 security patch level.
Forward mobile device crash and security event logs into a centralized analytics platform for correlation.
Alert on devices that exhibit Bluetooth radio activity in untrusted physical environments such as public venues.

How to Mitigate CVE-2025-0084

Immediate Actions Required

Apply the Android security patch level dated 2025-03-01 or later to all Android 13, 14, and 15 devices.
Inventory devices that cannot receive the March 2025 patch and prioritize remediation or replacement.
Disable Bluetooth on unpatched devices when not actively required for business operations.

Patch Information

Google published the fix in the Android Security Bulletin March 2025. The corresponding source code change is available in the Android Bluetooth Module Update. Device manufacturers ship the fix as part of their March 2025 or later monthly security updates.

Workarounds

Turn off Bluetooth via device settings when HFP functionality is not in use.
Restrict Bluetooth usage through mobile device management (MDM) policies on managed devices.
Avoid using Bluetooth in untrusted environments where adjacent attackers could be present.

bash

# Verify Android security patch level via ADB
adb shell getprop ro.build.version.security_patch

# Disable Bluetooth on a managed device via ADB
adb shell settings put global bluetooth_on 0