CVE-2025-22438
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In the afterKeyEventLockedInterruptable method of InputDispatcher.cpp, there is a possible use after free, which could lead to local escalation of privilege. User interaction is not needed.
Risk Assessment
Local privilege escalation could allow an attacker to take control of the system, potentially leading to data integrity and confidentiality compromise.
Recommendation
Update the system to a version that includes the fix for this vulnerability.
Other vulnerabilities in Android framework
See all- CVE-2017-0667High
CVE-2017-0667 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0666High
CVE-2017-0666 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0665High
CVE-2017-0665 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0664High
CVE-2017-0664 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2016-3832High
The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, allowing attackers to bypass an unspecified protection mechanism via a crafted application.
- CVE-2025-32347High
In the onStart method of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent, which could lead to local escalation of privilege. User interaction is needed.
Original NVD description (English source)
In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS