CVE-2025-22435 Overview
CVE-2025-22435 is a type confusion vulnerability [CWE-843] in the Android Bluetooth stack, specifically within the avdt_msg_ind function of avdt_msg.cc. The flaw allows memory corruption when processing Audio/Video Distribution Transport Protocol (AVDTP) messages from a paired Bluetooth device. A paired attacker can escalate privileges on the target device without requiring additional execution privileges or user interaction. Google addressed the issue in the April 2025 Android Security Bulletin. The vulnerability affects Android versions 13, 14, and 15.
Critical Impact
A paired Bluetooth device can trigger memory corruption in the Android Bluetooth stack to escalate privileges with no user interaction required.
Affected Products
- Google Android 13
- Google Android 14
- Google Android 15
Discovery Timeline
- 2025-09-02 - CVE-2025-22435 published to the National Vulnerability Database (NVD)
- 2025-09-04 - Last updated in NVD database
Technical Details for CVE-2025-22435
Vulnerability Analysis
The vulnerability resides in avdt_msg_ind within avdt_msg.cc, the Android Bluetooth module that handles inbound AVDTP signaling messages. AVDTP carries control messages between paired devices for audio and video streaming profiles such as A2DP. The function processes message indications received from a remote endpoint and dispatches them based on type fields embedded in the protocol headers.
A type confusion condition occurs when the code interprets a structure or object as a different type than what was actually allocated. The mismatched interpretation drives reads and writes against memory layouts that do not match the underlying object, producing memory corruption in the privileged bluetooth process. Because the Bluetooth daemon runs with elevated capabilities on Android, corruption of its memory provides a pathway to escalate privileges from a paired remote device into the platform.
The upstream fix is published in the Android Open Source Project Bluetooth module at commit efa5f4ef386a8947f4777840c5cefff389740e86.
Root Cause
The root cause is improper validation of object type information when handling AVDTP message indications. The code paths in avdt_msg_ind operate on data derived from attacker-controlled protocol fields without confirming that the in-memory object matches the expected type. This permits a crafted AVDTP message to drive execution down a branch that treats one structure as another, corrupting adjacent memory.
Attack Vector
The attack requires Bluetooth pairing between the attacker's device and the target. Once paired, the attacker sends a malformed AVDTP signaling message to the target. No user interaction is required during exploitation, and the attacker does not need additional privileges on the device. Successful exploitation yields code execution in the context of the Bluetooth process, enabling privilege escalation on the affected handset.
No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-22435
Indicators of Compromise
- Unexpected Bluetooth process (com.android.bluetooth) crashes or restarts in logcat and tombstone files referencing avdt_msg_ind or avdt_msg.cc.
- AVDTP signaling traffic from a paired device immediately preceding Bluetooth subsystem instability.
- Newly paired Bluetooth devices on managed handsets that lack a corresponding user enrollment record.
Detection Strategies
- Collect Android tombstones and bug reports through mobile device management (MDM) and alert on native crashes in the Bluetooth process originating from AVDTP message handlers.
- Monitor security patch level (ro.build.version.security_patch) across the fleet and flag devices below the April 2025 patch level as exposed.
- Correlate Bluetooth pairing events with subsequent process instability to identify attempted exploitation against paired endpoints.
Monitoring Recommendations
- Use MDM compliance policies to enforce minimum Android security patch levels and report non-compliant devices.
- Aggregate device telemetry, including Bluetooth daemon crash signatures, into a centralized log platform for hunting and historical review.
- Track Bluetooth pairing activity on high-value devices and require user confirmation workflows for new pairings.
How to Mitigate CVE-2025-22435
Immediate Actions Required
- Apply the April 2025 Android security patch level or later on all Android 13, 14, and 15 devices.
- Identify devices that cannot receive the patch and restrict their use in sensitive environments.
- Disable Bluetooth on affected devices when not required, particularly in public or untrusted areas.
- Remove unused Bluetooth pairings and audit existing pairings on managed handsets.
Patch Information
Google published the fix in the Android Security Bulletin April 2025. The source change is available in the Android Bluetooth Module Commit. Device manufacturers ship the fix through their respective monthly security update channels, so end users should install the April 2025 or later security patch level provided by their OEM.
Workarounds
- Keep Bluetooth disabled when the radio is not actively in use to remove the network-reachable attack surface.
- Avoid pairing with untrusted accessories and remove stale pairings from device settings.
- Enforce MDM policies that prohibit Bluetooth use on devices running pre-April 2025 patch levels.
# Verify the Android security patch level on a connected device
adb shell getprop ro.build.version.security_patch
# Expected output: 2025-04-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
