CVE-2025-20641
Published: 03 February 2025
Description
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291146; Issue ID: MSV-2058.
Security Summary
CVE-2025-20641 is an out-of-bounds write vulnerability in DA due to a missing bounds check. It affects MediaTek products, as documented in their product security bulletin.
An attacker with physical access to the device can exploit this vulnerability to achieve local escalation of privilege. No additional execution privileges are required, though user interaction is needed for exploitation. The vulnerability has a CVSS v3.1 base score of 6.6 (AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is associated with CWE-787.
MediaTek has issued patch ALPS09291146 to address this issue (MSV-2058). For mitigation details, affected versions, and patching instructions, refer to the February 2025 product security bulletin at https://corp.mediatek.com/product-security-bulletin/February-2025.
Details
- CWE(s)