Out-of-bounds write in MediaTek products - CVE-2025-20704

Vulnerability identifier: #VU114606

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-20704

CWE-ID: CWE-787

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the Modem component. A remote attacker with control over a rogue base station can trigger an out-of-bounds write and execute arbitrary code on the target system.

MT6813
MT6835
MT6835T
MT6878
MT6878M
MT6897
MT6899
MT6991
MT8676
MT8678
MT8792
MT8863
MT8873
MT8883
Lenovo Idea Tab Pro (TB373FU)
Lenovo Tab M11 (TB330FU/TB330XU)
Lenovo Tab K11 (TB330FU/TB330FUP/TB330XU/TB330XUP)
Lenovo Tab M9 (TB310FU/TB310XU/TB310XC)
Lenovo Tab K9 (TB305FU/TB305XU)
Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)
TB373FU Lenovo Idea Tab Pro
TB330FU/TB330XU Lenovo Tab B11/Lenovo Tab M11&K11
TB330FUP, TB330XUP Lenovo Tab K11 Enhanced
TB330FUP, TB330XUP Lenovo Tab K11 Edition
TB310XU, TB310FU Lenovo Tab M9
TB305FUXU Lenovo Tab One/Lenovo Tab K9
TB311FU/TB311XU Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case
Google Android

Install updates from vendor's website.

Google Android - addressed in versions 13 2025-09-05, 14 2025-09-05, 15 2025-09-05, 16 2025-09-05

• https://corp.mediatek.com/product-security-bulletin/September-2025

• Multiple vulnerabilities in MediaTek chipsets
• Multiple vulnerabilities in Google Android
• Multiple vulnerabilities in Lenovo Mediatek tablets