CVE-2025-22403: In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code…

PriorityP262critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.37%

29.7th percentile

In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
google	android	—	—
google	android	—	—
google	android	—	—
platform	packages_modules_bluetooth	>= 15-next:0 < 15-next:2025-03-01	15-next:2025-03-01
platform	packages_modules_bluetooth	>= 15:0 < 15:2025-03-01	15:2025-03-01

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability is in the function `sdp_snd_service_search_req` within `sdp_discovery.cc` — monitor for crashes or anomalous Bluetooth SDP (Service Discovery Protocol) traffic targeting this code path, particularly use-after-free exploitation patterns in the Android Bluetooth stack. ↗
→No user interaction is required for exploitation; this is a zero-click remote code execution vulnerability over Bluetooth. Detection should focus on anomalous or malformed Bluetooth SDP service search requests from untrusted/unexpected devices. ↗
→Only Android 15 devices are confirmed affected per the March 2025 Android Security Bulletin. Prioritize detection and patching efforts on Android 15 endpoints. ↗
→Track Android internal bug reference A-375409435 for patch availability and apply the March 2025 Android Security Bulletin patch to remediate. ↗

·Severity is rated CRITICAL with RCE impact and no privileges or user interaction required, making this a high-priority zero-click Bluetooth attack surface. ↗
·Only Android 15 is listed as an affected AOSP version in the March 2025 bulletin; earlier versions may or may not be affected but are not confirmed. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.