CVE-2025-20775

MEDIUM

Published Dec 2, 2025 Modified Jan 12, 2026 CWE-416

Description

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.

CVSS v3.1 Score

6.7

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-416 Use After Free

Affected Products

Vendor	Product	Versions
google	android	All
google	android	All
google	android	All
mediatek	mt6739	All
mediatek	mt6761	All
mediatek	mt6765	All
mediatek	mt6768	All
mediatek	mt6781	All
mediatek	mt6789	All
mediatek	mt6833	All
mediatek	mt6835	All
mediatek	mt6853	All
mediatek	mt6855	All
mediatek	mt6877	All
mediatek	mt6878	All
mediatek	mt6879	All
mediatek	mt6883	All
mediatek	mt6885	All
mediatek	mt6886	All
mediatek	mt6889	All
mediatek	mt6893	All
mediatek	mt6895	All
mediatek	mt6897	All
mediatek	mt6899	All
mediatek	mt6983	All
mediatek	mt6985	All
mediatek	mt6989	All
mediatek	mt6991	All
mediatek	mt8186	All
mediatek	mt8188	All
mediatek	mt8196	All
mediatek	mt8667	All
mediatek	mt8673	All
mediatek	mt8676	All
mediatek	mt8678	All
mediatek	mt8765	All
mediatek	mt8766	All
mediatek	mt8768	All
mediatek	mt8771	All
mediatek	mt8781	All
mediatek	mt8791t	All
mediatek	mt8792	All
mediatek	mt8793	All
mediatek	mt8795t	All
mediatek	mt8796	All
mediatek	mt8798	All
mediatek	mt8873	All
mediatek	mt8883	All

References

Advisories & Patches

https://corp.mediatek.com/product-security-bulletin/December-2025

Frequently Asked Questions

What is CVE-2025-20775? +

How severe is CVE-2025-20775? +

CVE-2025-20775 has a CVSS v3.1 score of 6.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-20775? +

CVE-2025-20775 affects products from google, mediatek, specifically: android, mt6739, mt6761, mt6765, mt6768, mt6781, mt6789, mt6833, mt6835, mt6853, mt6855, mt6877, mt6878, mt6879, mt6883, mt6885, mt6886, mt6889, mt6893, mt6895, mt6897, mt6899, mt6983, mt6985, mt6989, mt6991, mt8186, mt8188, mt8196, mt8667, mt8673, mt8676, mt8678, mt8765, mt8766, mt8768, mt8771, mt8781, mt8791t, mt8792, mt8793, mt8795t, mt8796, mt8798, mt8873, mt8883. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-20775? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-24898

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice …

CVE-2025-31115

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder …

CVE-2025-31498

c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue …

CVE-2025-4516

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an …

CVE-2025-5991

There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/2 handling, HTTP …

CVE-2025-49014

jq is a command-line JSON processor. In version 1.8.0 a heap use after free vulnerability exists within the function f_strflocaltime …