CVE-2025-20632
Published: 03 February 2025
Description
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00397139; Issue ID: MSV-2188.
Security Summary
CVE-2025-20632 is a vulnerability in the wlan AP driver that enables an out-of-bounds write due to an incorrect bounds check. This issue, tracked as CWE-787 with Issue ID MSV-2188, affects MediaTek components and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker requires only low privileges to exploit this vulnerability, which has low attack complexity and needs no user interaction or additional execution privileges. Exploitation can lead to local escalation of privilege, resulting in high impacts to confidentiality, integrity, and availability.
MediaTek's February 2025 product security bulletin provides mitigation details, including Patch ID WCNCR00397139. Security practitioners should consult https://corp.mediatek.com/product-security-bulletin/February-2025 and apply the patch to vulnerable systems.
Details
- CWE(s)