CVE-2025-20722
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-15

Assigner: MediaTek, Inc.

Description
In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-14
Last Modified
2025-10-15
Generated
2026-06-16
AI Q&A
2025-10-14
EPSS Evaluated
2026-06-15
NVD
CVE-2025-20722
EUVD
EUVD-2025-34168
Affected Vendors & Products
Showing 21 associated CPEs
Vendor Product Version / Range
rdkcentral rdk-b 2024q1
google android 14.0
google android 15.0
openwrt openwrt 21.02.0
openwrt openwrt 23.05
mediatek mt6835 *
mediatek mt6878 *
mediatek mt6886 *
mediatek mt6897 *
mediatek mt6899 *
mediatek mt6980d *
mediatek mt6985 *
mediatek mt6989 *
mediatek mt6990 *
mediatek mt6991 *
mediatek mt8676 *
mediatek mt8678 *
mediatek mt8775 *
mediatek mt8791t *
mediatek mt8796 *
mediatek mt8873 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an out of bounds read in the gnss driver caused by an integer overflow. It can be exploited locally by someone who already has System privilege, and does not require user interaction.

Impact Analysis

The vulnerability could lead to local information disclosure if exploited by a malicious actor with System privilege.

Mitigation Strategies

Apply the patch identified as ALPS09920036 provided by the vendor to fix the vulnerability in the gnss driver. Ensure that only trusted users have System privileges to reduce risk, as exploitation requires such privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-20722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart