BaseFortify

Publication date: 2025-12-02

Last updated on: 2025-12-03

Assigner: MediaTek, Inc.

Description

In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-02

Last Modified

2025-12-03

Generated

2026-07-06

AI Q&A

2025-12-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-20768

Affected Vendors & Products

Vendor	Product	Version / Range
google	android	14.0
google	android	15.0
google	android	16.0
mediatek	mt6739	*
mediatek	mt6761	*
mediatek	mt6765	*
mediatek	mt6768	*
mediatek	mt6781	*
mediatek	mt6789	*
mediatek	mt6833	*
mediatek	mt6835	*
mediatek	mt6853	*
mediatek	mt6855	*
mediatek	mt6877	*
mediatek	mt6878	*
mediatek	mt6879	*
mediatek	mt6883	*
mediatek	mt6885	*
mediatek	mt6886	*
mediatek	mt6889	*
mediatek	mt6893	*
mediatek	mt6895	*
mediatek	mt6897	*
mediatek	mt6899	*
mediatek	mt6983	*
mediatek	mt6985	*
mediatek	mt6989	*
mediatek	mt6991	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out of bounds read in the display component caused by a missing bounds check. It allows reading memory outside the intended buffer limits.

Impact Analysis

If a malicious actor has already obtained System privilege, this vulnerability could lead to local escalation of privilege, potentially allowing the attacker to gain higher-level access on the system without user interaction.

Hi! I’m here to help you understand CVE-2025-20768. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70