In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-22406 |
Exploitation
The vulnerability can be exploited locally without any user interaction. An attacker can leverage the use after free condition in the bnepu_check_send_packet function to execute arbitrary code, potentially leading to a local escalation of privileges.
Affected Products
- Bluetooth module in Android: Vulnerable to code execution due to improper memory management.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Android. Users should ensure their devices are running the most recent version of the operating system to protect against potential exploits.