CVE-2025-22431: Medium severity Google Android vulnerability
In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running affected Google Android software are exposed if a malicious app can run locally on the device. The issue does not require user interaction or additional execution privileges.
What is the practical impact of exploitation?
A malicious app may prevent the device from dialing emergency services in limited circumstances. The resulting denial of service lasts until the phone is rebooted.
Is remote exploitation indicated?
No. The CVSS vector identifies local attack access, so an attacker needs a malicious app to be present and running on the device.
What can be done if an update cannot be applied immediately?
The provided information identifies rebooting the phone as restoring emergency dialing after exploitation. It does not provide other mitigations or affected-version details.