PT-2025-43452 · Unknown · Callredirectionprocessor.Java

Published 2025-04-01 · Updated 2025-12-10 · CVE-2025-22432

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025-22432

Description A persistent connection may occur due to improper input validation within the notifyTimeout function of the CallRedirectionProcessor.java component. This could potentially allow for local escalation of privilege and the launch of background activities requiring User execution privileges. User interaction is not required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ASB-A-376461726

CVE-2025-22432

Affected Products

Callredirectionprocessor.Java

References · 12

• https://source.android.com/security/bulletin/2025-12-01 · Vendor Advisory
• https://android.googlesource.com/platform/packages/services/Telecomm/+/a43a880beaa6a64348a1d0c821e8c7e98d741a79 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-22432 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22432 · Vendor Advisory
• https://osv.dev/vulnerability/ASB-A-376461726 · Vendor Advisory
• https://android.googlesource.com/platform/packages/services/Telecomm/+/284cf771ae8fcb8b215df055ce7ddbdbdcddb4a4 · Note
• https://t.me/cveNotify/145197 · Telegram Post
• https://source.android.com/security/bulletin/2025-04-01 · Note
• https://t.me/cveNotify/145314 · Telegram Post
• https://twitter.com/CVEnew/status/1998079608692801934 · Twitter Post
• https://reddit.com/r/androiddev/comments/1oe10qe/checking_if_my_android_devices_have_critical_high · Reddit Post
• https://twitter.com/dailycve/status/1998808807968035254 · Twitter Post