CVE-2025-20658

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-07 · updated 2026-06-17
Weakness: CWE-787

Description

In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.

Affected products

Android: 12.0, 13.0, 14.0, 15.0
Mediatek Mt2718: all versions
Mediatek Mt6781: all versions
Mediatek Mt6789: all versions
Mediatek Mt6835: all versions
Mediatek Mt6855: all versions
Mediatek Mt6878: all versions
Mediatek Mt6879: all versions
Mediatek Mt6886: all versions
Mediatek Mt6895: all versions
Mediatek Mt6897: all versions
Mediatek Mt6983: all versions
Mediatek Mt6985: all versions
Mediatek Mt6989: all versions
Mediatek Mt8196: all versions
Mediatek Mt8673: all versions
Mediatek Mt8676: all versions
Mediatek Mt8678: all versions
Mediatek Mt8781: all versions

References

https://corp.mediatek.com/product-security-bulletin/April-2025

Get alerted when CVE-2025-20658 or the next vulnerability affects your stack