Out-of-bounds write in MediaTek products - CVE-2025-20646

Vulnerability identifier: #VU105188

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-20646

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation within wlan. A local application can execute arbitrary code.

MT6890
MT7915
MT7916
MT7981
MT7986
ThinkPad T14s Gen 3 21CR
ThinkPad S2 Gen 8 Types 21FT China Only
ThinkPad S2 Yoga Gen 8 21FU
ThinkPad L13 Yoga Gen 4 21FS
ThinkPad L13 Yoga Gen 4 21FR
ThinkPad L13 Gen 4 21FQ
ThinkPad L13 Gen 4 21FN
ThinkPad X13 Gen 3 21CN
ThinkPad X13 Gen 3 21CM
ThinkPad T16 Gen 1 21CJ
ThinkPad T16 Gen 1 21CH
ThinkPad E14 Gen 5 21JR
ThinkPad T14s Gen 3 21CQ
ThinkPad T14 Gen 3 21CG
ThinkPad T14 Gen 3 21CF
ThinkPad P16s Gen 1 21CL
ThinkPad P16s Gen 1 21CK
ThinkPad P14s Gen 3 21J6
ThinkPad P14s Gen 3 21J5
ThinkPad Z16 Gen 1 21D5
ThinkPad Z16 Gen 1 21D4
ThinkPad P16s Gen 2 21K9
ThinkPad Z16 Gen 2 21JY
ThinkPad Z16 Gen 2 21JX
ThinkPad Z13 Gen 2 21JW
ThinkPad Z13 Gen 2 21JV
ThinkPad T16 Gen 2 21K8
ThinkPad T16 Gen 2 21K7
ThinkPad T14 Gen 4 21K4
ThinkPad T14 Gen 4 21K3
ThinkPad P16s Gen 2 21KA
ThinkPad Z13 Gen 1 21D3
ThinkPad P14s Gen 4 21K6
ThinkPad P14s Gen 4 21K5
ThinkPad L15 Gen 4 21H8
ThinkPad L15 Gen 4 21H7
ThinkPad L14 Gen 4 21H6
ThinkPad L14 Gen 4 21H5
Thinkpad E16 Gen 1 21JU
Thinkpad E16 Gen 1 21JT
ThinkPad E14 Gen 5 21JS
ThinkEdge SE10
ThinkPad E14 Gen 2 20T6
ThinkPad R14 Gen 2 Type 20TC PRC
ThinkPad L15 20U4
ThinkPad L15 20U3
ThinkPad L14 20U2
ThinkPad L14 20U1
ThinkPad E15 Gen 2 20TE
ThinkPad E15 Gen 2 20TD
ThinkPad E14 Gen 2 20TB
ThinkPad E14 Gen 2 20TA
ThinkPad E14 Gen 2 20T7
ThinkPad T14 Gen 1 20UE
ThinkPad Z13 Gen 1 21D2
ThinkPad L13 Yoga Gen 2 21AE
ThinkPad L13 Yoga Gen 2 21AD
ThinkPad L13 Gen 2 21AC
ThinkPad L13 Gen 2 21AB
ThinkPad X13 20UG
ThinkPad X13 20UF
ThinkPad T14s 20UJ
ThinkPad T14s 20UH
ThinkPad T14 Gen 1 20UD
ThinkPad P14s Gen 1 20Y2
ThinkPad P14s Gen 1 20Y1
ThinkPad L15 20U8
ThinkPad L15 20U7
ThinkPad L14 20U6
ThinkPad L14 20U5
ThinkPad E15 Gen 2 20T9
ThinkPad E15 Gen 2 20T8
MediaTek Wireless Driver for Windows 11 (Version 21H2 or later), 10 (Version 21H2 or later) - ThinkPad Z13 Gen 2, Z16 Gen 2
RZ616 Wireless LAN Driver for Windows 11 (Version 21H2 or later), 10 64-bit (Version 21H2 or later) - ThinkPad
Mediatek AMD RZ616 Wireless LAN Driver for Windows 11 (Version 21H2 or later) and 10 (Version 21H2 or later) - ThinkPad L13 Gen 4, L13 Yoga Gen 4
RZ616 Wireless LAN Driver for Windows 11 (Version 21H2 or later), 10 (Version 20H2 or later) - ThinkPad
RZ616 Wireless LAN Driver for Windows 11 (Version 21H2 or later) - ThinkPad Z13 (Type 21D2, 21D3), Z16 (Type 21D4, 21D5)
Mediatek RZ616 Wireless LAN driver for Windows 10 (Version 20H2 or later) - ThinkPad Z13 (Type 21D2, 21D3), Z16 (Type 21D4, 21D5)
Mediatek Wireless LAN Driver for Windows 10 (Version 1909 or later) - ThinkPad L13 Gen 2, L13 Yoga Gen 2
Mediatek MT7921 WLAN Driver for Windows 11 (Version 21H2 or later) and 10 (Version (1909 or later) - ThinkPad
Mediatek MT7921 WLAN Driver for Windows 11 (Version 21H2 or later), 10 (Version 1909 or later) - ThinkPad
Foxconn MT7921 WLAN Driver for Windows 10 IoT (64-bit) (For 2019) - ThinkEdge SE10

Install security update from vendor's website.

• https://corp.mediatek.com/product-security-bulletin/March-2025

• Multiple vulnerabilities in MediaTek chipsets
• Privilege escalation in Lenovo WLAN Driver for Mediatek chipsets