CVE-2025-20721

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-20721
In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://corp.mediatek.com/product-security-bulletin/October-2025 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:mediatek:iot_yocto:25.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*
OR cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*
History

15 Oct 2025, 18:45

Type Values Removed Values Added
References () https://corp.mediatek.com/product-security-bulletin/October-2025 - () https://corp.mediatek.com/product-security-bulletin/October-2025 - Vendor Advisory
CPE cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*
cpe:2.3:a:mediatek:iot_yocto:25.0:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*
First Time Mediatek
Mediatek iot Yocto
Mediatek mt6886
Mediatek mt6899
Mediatek mt8792
Mediatek mt8370
Mediatek mt8793
Mediatek mt8390
Mediatek mt6989
Google
Mediatek mt8196
Mediatek mt8195
Mediatek mt6897
Mediatek mt6991
Mediatek mt6985
Mediatek mt8395
Google android

14 Oct 2025, 14:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

14 Oct 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-10-14 10:15

Updated : 2025-10-15 18:45

NVD link : CVE-2025-20721

Mitre link : CVE-2025-20721

CVE.ORG link : CVE-2025-20721

JSON object : View

Products Affected

mediatek

  • iot_yocto
  • mt6985
  • mt6897
  • mt6899
  • mt8395
  • mt8793
  • mt8195
  • mt6989
  • mt8196
  • mt8792
  • mt8370
  • mt6991
  • mt8390
  • mt6886

google

  • android
CWE
CWE-787

Out-of-bounds Write