CVE-2025-20722

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-15

Assigner: MediaTek, Inc.

Description

In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2025-10-15

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-20722

EUVD

EUVD-2025-34168

Affected Vendors & Products

Vendor	Product	Version / Range
rdkcentral	rdk-b	2024q1
google	android	14.0
google	android	15.0
openwrt	openwrt	21.02.0
openwrt	openwrt	23.05
mediatek	mt6835	*
mediatek	mt6878	*
mediatek	mt6886	*
mediatek	mt6897	*
mediatek	mt6899	*
mediatek	mt6980d	*
mediatek	mt6985	*
mediatek	mt6989	*
mediatek	mt6990	*
mediatek	mt6991	*
mediatek	mt8676	*
mediatek	mt8678	*
mediatek	mt8775	*
mediatek	mt8791t	*
mediatek	mt8796	*
mediatek	mt8873	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an out of bounds read in the gnss driver caused by an integer overflow. It can be exploited locally by someone who already has System privilege, and does not require user interaction.

Impact Analysis

The vulnerability could lead to local information disclosure if exploited by a malicious actor with System privilege.

Mitigation Strategies

Apply the patch identified as ALPS09920036 provided by the vendor to fix the vulnerability in the gnss driver. Ensure that only trusted users have System privileges to reduce risk, as exploitation requires such privileges.

Hi! I’m here to help you understand CVE-2025-20722. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70