IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.8Media

CVE-2025-20656

MediaTek, Inc. MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6886, MT6895, MT6897, MT6983, MT6985, MT6989, MT6990, MT8196, MT8370, MT8390 Publicada: (hace 1 año)

Descripción

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423; Issue ID: MSV-3033.

Debilidad (CWE): CWE-787

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
google android 12.0
linuxfoundation yocto 4.0
mediatek mt6781 —
MediaTek, Inc. MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT6886, MT6895, MT6897, MT6983, MT6985, MT6989, MT6990, MT8196, MT8370, MT8390 Android 12.0, 13.0, 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1
mediatek mt6789 —
mediatek mt6835 —
mediatek mt6855 —
mediatek mt6878 —
mediatek mt6879 —
mediatek mt6886 —
mediatek mt6895 —
mediatek mt6897 —
mediatek mt6983 —
mediatek mt6985 —
mediatek mt6989 —
mediatek mt6990 —
mediatek mt8196 —
mediatek mt8370 —
mediatek mt8390 —
openwrt openwrt 21.02.0
rdkcentral rdk-b 2024q1

Referencias y parches

Coincidencias CPE (NVD) (24)
  • cpe:2.3:a:linuxfoundation:yocto:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:rdkcentral:rdk-b:2024q1:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
  • cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*
  • cpe:2.3:o:openwrt:openwrt:23.05:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*
  • cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*

CVE recientes del mismo producto — Android

6.7Media
CVE-2026-58977
Google Android

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

7.8Alta
CVE-2026-58930
Google Android

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, injec…

6.7Media
CVE-2026-58927
Google Android

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOTIVE_EVS`) can cause a …

2.5Baja
CVE-2026-58926
Google Android

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `doneWithFrame` and `setMaxFramesInFlight`, enables an attacke…

7.8Alta
CVE-2026-58925
Google Android

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the EVS manager can trigg…

7.5Alta
CVE-2026-58924
Google Android

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within th…