CVE-2025-20727
Published: 04 November 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-20727 is a heap buffer overflow vulnerability in the Modem component, resulting in an out-of-bounds write. It affects MediaTek products incorporating this modem software. Published on 2025-11-04T07:15:34.540, the issue is tracked under CWE-787 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by an attacker who controls a rogue base station. When user equipment (UE) connects to the rogue base station, the attacker can trigger the heap buffer overflow, leading to escalation of privilege. No additional execution privileges or user interaction are required.
MediaTek's November 2025 product security bulletin addresses the issue with Patch ID MOLY01672601 for Issue ID MSV-4623. Practitioners should consult https://corp.mediatek.com/product-security-bulletin/November-2025 for mitigation guidance and patch deployment details.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Heap buffer overflow in modem exploited remotely via rogue base station, directly leading to privilege escalation.