Out-of-bounds write in MediaTek products - CVE-2025-20671
Published: May 5, 2025
Vulnerability identifier: #VU108518
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-20671
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in thermal. A local user can trigger an out-of-bounds write and gain elevated privileges on the target system.
Affected software
MT2718
MT6878
MT6897
MT6899
MT6989
MT6991
MT8196
MT8391
MT8676
MT8678
MT6878
MT6897
MT6899
MT6989
MT6991
MT8196
MT8391
MT8676
MT8678
How to mitigate CVE-2025-20671
Install updates from vendor's website.