CVE-2025-48593

In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

Android

Google Android

= 13.0, 14.0, 15.0, 16.0

Fix

Available

CVSS 3.1

8.0 HIGH

EPSS

0.9% (57th percentile)

Weakness

CWE-416

NVD status

Analyzed

Published

2025-11-18