CVE-2025-0074: In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code…

PriorityP261critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.41%

33.2th percentile

In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
google	android	—	—
google	android	—	—
google	android	—	—
platform	packages_modules_bluetooth	>= 15-next:0 < 15-next:2025-03-01	15-next:2025-03-01
platform	packages_modules_bluetooth	>= 15:0 < 15:2025-03-01	15:2025-03-01

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability is triggered in the `process_service_attr_rsp` function within `sdp_discovery.cc` — monitor for crashes or anomalous behavior in the Bluetooth SDP (Service Discovery Protocol) stack, specifically in this function. ↗
→The vulnerability is a use-after-free in the Bluetooth SDP discovery response handler, exploitable remotely with no user interaction — treat unexpected Bluetooth SDP attribute response handling as a high-risk attack vector on Android 15 devices. ↗
→Target scope is limited to Android 15; prioritize detection and patching efforts on devices running AOSP version 15. ↗

·The Android Security Bulletin references internal bug tracker ID A-375408314 for this CVE; no public exploit code or PoC has been referenced in the available sources. ↗
·Severity is rated CRITICAL with RCE classification and zero-click (no user interaction) exploitation, meaning network-adjacent Bluetooth attackers can exploit without any victim action. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.