March 2025: the bulletin, and what actually shipped

The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.

At a glance

The bulletin also has 13 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.

What this month's security tags add

Each security tag published this month, and the CVEs whose public fix first appears in it. CVEs resolved by an earlier tag are not repeated here; they are in the table above and on each CVE page.

android-security-14.0.0_r18 adds the fix for 9 CVEs: CVE-2024-49740, CVE-2025-0078, CVE-2025-0079, CVE-2025-0081, CVE-2025-0082, CVE-2025-0083, CVE-2025-0084, CVE-2025-0086, CVE-2025-26417.

android-security-15.0.0_r6 adds the fix for 10 CVEs: CVE-2024-43090, CVE-2025-0078, CVE-2025-0079, CVE-2025-0080, CVE-2025-0081, CVE-2025-0082, CVE-2025-0083, CVE-2025-0084, CVE-2025-0086, CVE-2025-26417.

Announced, with no public code

None this month.

Public before it was announced

The fixing commit was in a public security tag before the bulletin announced the CVE.

Fixed, by a probable match

None this month.

Security fixes no advisory mentions

Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.

Android 14: 1 fix in android-security-14.0.0_r18

Fix analysis AI-generated

For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.

• CVE-2024-0032 · platform/frameworks/base (com.android.internal.content.FileSystemProvider
  Replaces FileSystemProvider's exact-match regex for /Android/{data,obb,sandbox} with an overridable shouldHideDocument(documentId) hook. ExternalStorageProvider implements the hook to hide those directories and their entire subtrees (on non-USB storage) from queryChildDocuments, querySearchDocuments and the open-tree flag. The fix also consolidates the queryChildDocuments variants around a single includeHidden parameter.
• CVE-2024-43090 · platform/frameworks/base
  SystemUI's keyboard shortcut helper now strips any Icon carried in app-provided KeyboardShortcutInfo objects before the shortcuts are displayed. It does this through a new @hide KeyboardShortcutInfo.clearIcon(), called from a new KeyboardShortcuts.sanitiseShortcuts() helper.
• CVE-2024-43093 · platform/frameworks/base
  ExternalStorageProvider replaces the regex string match used to hide Android/data, Android/obb and Android/sandbox (and their subtrees) with a filesystem identity check (Files.isSameFile). The check walks the resolved file path and its parents against the restricted directories that exist under the document's root, and fails closed on any error.
• CVE-2024-49740 · platform/packages/services/Telephony (PhoneInterfaceManager
  Adds server-side enforcement in PhoneInterfaceManager so that only the visual voicemail package (default dialer, system dialer or carrier VVM app) can enable or disable the visual voicemail SMS filter. It also limits the size of VisualVoicemailSmsFilterSettings fields in the Builder: clientPrefix at most 256 chars, originatingNumbers at most 100 entries of at most 256 chars each.
• CVE-2025-0074 · platform/packages/modules/Bluetooth
  Two log::warn statements in system/stack/sdp/sdp_discovery.cc read p_cmd->len / p_msg->len after a failed L2CA_DataWrite. They now log the locally computed length (p - p_start), so the buffer that may have been freed is no longer dereferenced.
• CVE-2025-0075 · platform/packages/modules/Bluetooth
  In system/stack/sdp/sdp_server.cc process_service_search_attr_req, the warning logged when L2CA_DataWrite fails no longer reads p_buf->len, because p_buf may already have been freed. It now computes the length from the local pointers p_rsp - p_rsp_start.
• CVE-2025-0078 · platform/frameworks/native
  servicemanager now calls setRequestingSid(true) on its own ServiceManager object before it registers itself as the "manager" service, so the flags on the self-registered object match the special flags used for the context object.
• CVE-2025-0079 · platform/packages/modules/Bluetooth
  Adds an encryption requirement (BTA_SEC_ENCRYPT / BTM_SEC_OUT_ENCRYPT) next to the existing authentication requirement for the AVDTP and AVCTP L2CAP PSM registrations and outgoing connect requests in the Bluetooth stack.
• CVE-2025-0080 · platform/frameworks/base
  The fix hardens the PackageInstaller unarchive confirmation UI against overlays in two ways: it adds SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS to UnarchiveActivity's window, and it disables the dialog's Restore button whenever UnarchiveFragment is paused, then re-enables it on resume.
• CVE-2025-0081 · platform/external/dng_sdk
  Adds a null-pointer check at the top of dng_lossless_decoder::HuffDecode in external/dng_sdk, so a null Huffman table during lossless JPEG decoding triggers ThrowBadFormat instead of being dereferenced.
• CVE-2025-0082 · platform/frameworks/base (telecomm/java/android/telecom/StatusHints.java) and platform/packages/services/Telecomm (TelecomServiceImpl)
  Replaces the Uri.getEncodedUserInfo()-based cross-user icon check in telecom StatusHints and TelecomServiceImpl (phone account registration) with a new StatusHints.getUserIdFromAuthority() helper that derives the user id from the URI authority (getAuthority()) and rejects any mismatch or unparsable user id.
• CVE-2025-0083 · platform/frameworks/base (telecomm/java/android/telecom/StatusHints.java) and platform/packages/services/Telecomm (TelecomServiceImpl phone account icon validation)
  Replaces the Uri.getEncodedUserInfo()-based cross-user check on content-URI icons in StatusHints and in TelecomServiceImpl (phone account registration) with a new StatusHints.getUserIdFromAuthority() helper. The helper parses the user id from Uri.getAuthority() and rejects any icon whose user id differs from the caller's, including the percent-encoded test forms and non-numeric prefixes.
• CVE-2025-0084 · platform/packages/modules/Bluetooth
  Adds a guard in bta_hf_client_do_disc that aborts discovery when the HF client control block already owns an SDP discovery database, and a NULL check on p_ccb->p_db in process_service_search_attr_rsp that disconnects the SDP connection instead of continuing with no database.
• CVE-2025-0086 · platform/frameworks/base
  Adds a check in AccountManagerService's getAuthToken result handler that rejects an authenticator response whose KEY_ACCOUNT_TYPE differs from the session's account type, returning ERROR_CODE_INVALID_RESPONSE instead of storing the token.
• CVE-2025-0092 · platform/packages/modules/Bluetooth
  The fix resets a remote device's Message Access, Phonebook Access and SIM Access permissions to ACCESS_UNKNOWN whenever its bond state transitions to BOND_NONE, so that access granted while a device was bonded does not survive unbonding.
• CVE-2025-0093 · platform/packages/modules/Bluetooth
  When a device's bond state changes to BOND_NONE, the Bluetooth stack now resets that device's Message Access (MAP), Phonebook Access (PBAP) and SIM Access permissions to ACCESS_UNKNOWN, so access granted earlier does not survive unbonding.
• CVE-2025-22403 · platform/packages/modules/Bluetooth
  Replaces two log::warn arguments in system/stack/sdp/sdp_discovery.cc. They read p_cmd->len / p_msg->len after the buffer had been passed to L2CA_DataWrite, which per the commit message may have freed it in exceptional cases. The fix logs the locally computed length p - p_start instead.
• CVE-2025-22404 · platform/packages/modules/Bluetooth
  Before each L2CA_DataWrite call, the fix saves the BT_HDR length (or uses pointer arithmetic), so the failure-path log::warn statements in AVCT, BNEP, HID device, RFCOMM and SDP no longer read a buffer that the call may already have freed.
• CVE-2025-22405 · platform/packages/modules/Bluetooth
  At nine Bluetooth stack call sites in eight files, the failure log after L2CA_DataWrite() no longer reads the BT_HDR buffer that was passed to that call (the commit message says such a buffer may already be freed). The length is now saved in a local variable before the call or recomputed from existing pointers.
• CVE-2025-22406 · platform/packages/modules/Bluetooth
  At nine L2CAP send sites in eight Bluetooth stack files (AVCT, BNEP, HID device, RFCOMM, SDP), the log::warn on the failure path no longer reads the BT_HDR buffer after it has been passed to L2CA_DataWrite. The length is now saved in a local before the call or computed from pointers the code already has.
• CVE-2025-22407 · platform/packages/modules/Bluetooth
  Across nine L2CA_DataWrite call sites in the Bluetooth stack (AVCT, BNEP, HID device, RFCOMM, SDP), the failure-path log::warn no longer dereferences the BT_HDR buffer that was passed to L2CA_DataWrite; instead the length is stored in a local before the call or recomputed from pointer arithmetic.
• CVE-2025-22408 · platform/packages/modules/Bluetooth
  Across nine L2CAP send sites in eight Bluetooth stack files (AVCTP, BNEP, HID device, RFCOMM, SDP client and server), the failure-path log::warn no longer reads ->len from the BT_HDR buffer after L2CA_DataWrite. The length is now saved in a local before the call, or taken from the pointer difference already computed for it.
• CVE-2025-22409 · platform/packages/modules/Bluetooth
  Nine failure-path log statements in the Bluetooth stack (AVCT, BNEP, HID device, RFCOMM, SDP) read the buffer length after passing the buffer to L2CA_DataWrite. They now use a length captured before the call, or a pointer difference that was already computed, so they no longer read a buffer that may already have been freed.
• CVE-2025-22410 · platform/packages/modules/Bluetooth
  Across nine L2CA_DataWrite call sites in the Bluetooth stack (AVCTP, BNEP, HID device, RFCOMM, SDP), the failure-path log statement is changed to use a length captured before the call (a local variable or a pointer difference) instead of reading the BT_HDR buffer, which may have been freed by the time the log runs.
• CVE-2025-22411 · platform/packages/modules/Bluetooth
  In nine log::warn statements across the AVCT, BNEP, HID device, RFCOMM and SDP layers of the Bluetooth stack, the fix stops reading the BT_HDR buffer's len field after the buffer has been passed to L2CA_DataWrite. It either captures the length in a local before the call or recomputes it with pointer arithmetic.
• CVE-2025-22412 · platform/packages/modules/Bluetooth
  At nine Bluetooth stack call sites, the log::warn issued after a failed L2CA_DataWrite no longer reads the length from a BT_HDR buffer (p_buf->len, p->len, hd_cb.pending_data->len) that may already have been freed. The length is now captured before the call or taken from a pointer difference computed earlier.
• CVE-2025-26417 · platform/packages/providers/DownloadProvider
  Adds an ownership check to DownloadProvider's insert destination-path validation: if MediaStore already has a record for the target file path, the calling UID must own a package equal to that record's OWNER_PACKAGE_NAME, otherwise a SecurityException is thrown.

Bulletin revisions

• No change seen since tracking started (2026-09-30).

Method and limits

Fixes are found in the public android-security-* tags by the bug id in the commit message, then Change-Id and patch id against the bulletin's commit, then two probable matches checked by content. "No public code" means no fixing commit in the ingested tags of that major, not proof that no fix exists anywhere. When none of the code the bulletin's commit patches exists in a major (removed or reworked before its release), the CVE is shown as "patched code absent" instead. Vendor closed-source components and the kernel are out of scope.

Data for this page (JSON).