A vulnerability exists in multiple locations that allows for a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth if HFP support is enabled, without requiring additional execution privileges. User interaction is not necessary for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-0084 |
Exploitation
To exploit this vulnerability, an attacker can leverage the Bluetooth HFP support feature to execute arbitrary code remotely without any user interaction. This can be achieved by sending specially crafted packets to the target device over an adjacent network.
Affected Products
- Bluetooth-enabled Android devices with HFP support enabled.
Mitigation
To mitigate this vulnerability, it is recommended to disable HFP support on devices that do not require it. Additionally, users should ensure their devices are updated with the latest security patches provided by the vendor.