A vulnerability in rfc_send_buf_uih of rfc_ts_frames.cc allows for the execution of arbitrary code due to a use after free. This could lead to local escalation of privilege without requiring additional execution privileges. User interaction is not necessary for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-22409 |
Exploitation
To exploit this vulnerability, an attacker could leverage the use after free condition in the rfc_send_buf_uih function, allowing them to execute arbitrary code on the affected system. This can be done locally without any user interaction, making it particularly dangerous.
Affected Products
- Android Bluetooth Module: Vulnerable to arbitrary code execution due to improper memory management.
- Android Devices: All devices running the affected Bluetooth module are at risk of local privilege escalation.
Mitigation
To mitigate this vulnerability, users should ensure their Android devices are updated with the latest security patches provided by the manufacturer. Regularly checking for updates can help protect against known vulnerabilities.