CVE-2025-22432: 
NixOS vulnerability analysis and mitigation

CVE-2025-22432 is a local privilege escalation vulnerability in Android's CallRedirectionProcessor.java, specifically in the notifyTimeout method, caused by improper input validation that can result in a persistent connection. It affects Android versions 13, 14, 15, and 16. The vulnerability was first disclosed in the April 2025 Android Security Bulletin and formally patched in the December 2025 Android Security Bulletin. It carries a CVSS v3.1 base score of 6.7 (Medium), requiring high privileges locally but no user interaction (Android Security Bulletin).

The root cause is improper input validation (CWE-20) in the notifyTimeout method of CallRedirectionProcessor.java, a component within Android's Telecomm services. The flaw allows a locally privileged attacker to create a persistent connection that can be leveraged to launch background activities and escalate privileges. Exploitation requires local access with high privileges (e.g., a malicious app with elevated permissions) but does not require any user interaction. A patch was committed to the Android Telecomm service repository (Android Googlesource, Android Security Bulletin).

Successful exploitation can lead to local escalation of privilege and unauthorized background activity launches on affected Android devices. The vulnerability has high confidentiality, integrity, and availability impact, meaning an attacker could potentially access sensitive data, modify system state, or disrupt device functionality. The attack scope is limited to the local device and does not enable direct remote exploitation or lateral movement across a network (Android Security Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is extremely low at 0.000050, reflecting minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Android Security Bulletin).

Google released a patch for CVE-2025-22432 in the December 2025 Android Security Bulletin (patch level 2025-12-01). The specific fix is available in the Android Telecomm service repository. Users and administrators should apply the December 2025 Android security patch immediately. As a general precaution, restricting installation of untrusted applications and monitoring for unusual background activity can reduce risk on unpatched devices (Android Security Bulletin, Android Googlesource).

Samsung published its April 2025 security patch details referencing this CVE among over 60 vulnerabilities fixed, indicating OEM adoption of the upstream patch (SammyFans). GrapheneOS also addressed this vulnerability in its October 2025 release. Coverage has been limited to routine security bulletin roundups with no notable independent researcher commentary or significant social media discussion.