What’s Vulnerable › Vulnerabilities

CVE-2025-20656

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-07 · updated 2026-06-17
• Weakness: CWE-787

Description

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423; Issue ID: MSV-3033.

Affected products

• Android: 12.0, 13.0, 14.0, 15.0
• Linuxfoundation Yocto: 4.0
• Mediatek Mt6781: all versions
• Mediatek Mt6789: all versions
• Mediatek Mt6835: all versions
• Mediatek Mt6855: all versions
• Mediatek Mt6878: all versions
• Mediatek Mt6879: all versions
• Mediatek Mt6886: all versions
• Mediatek Mt6895: all versions
• Mediatek Mt6897: all versions
• Mediatek Mt6983: all versions
• Mediatek Mt6985: all versions
• Mediatek Mt6989: all versions
• Mediatek Mt6990: all versions
• Mediatek Mt8196: all versions
• Mediatek Mt8370: all versions
• Mediatek Mt8390: all versions
• openwrt: 21.02.0, 23.05
• Rdkcentral Rdk-B: 2024q1

References

• https://corp.mediatek.com/product-security-bulletin/April-2025

Get alerted when CVE-2025-20656 or the next vulnerability affects your stack