CVE-2025-48593

Name of the Vulnerable Software and Affected Versions Android versions 13 through 16

Description A critical zero-click remote code execution issue exists in the Bluetooth stack of the Android operating system. This flaw, identified as CVE-2025-48593, is due to a use-after-free condition within the

bta hf client cb init

function of

bta hf client main.cc

. Exploitation does not require user interaction; an attacker can trigger the issue by sending specially crafted network packets or malicious applications. Successful exploitation allows for full device takeover, including data theft and the potential installation of ransomware. The issue primarily affects devices acting as Bluetooth headphones, such as smartwatches, smart glasses, and cars. The vulnerability is rated as critical, with a severity score of 9.8 out of 10.

Recommendations Update to the security patch level 2025-11-01 or newer.