Patch days / September 2025

Android Security Bulletin — September 2025

Monday, 1 September 2025

Vulnerabilities: 25
Critical: 3
High: 17
Zero-days: 0
Public exploit: 1

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

Critical 9.8
CVE-2025-22429 In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege wit…
Critical 9.8
CVE-2025-22435 In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no a…
Critical 9.8
CVE-2025-26416 In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of…

Public exploit code 1

Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.

High 7.0
CVE-2025-22442 Public exploit In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to…

All vulnerabilities 25

Critical3 Show

High17 Show

Medium5 Show