Stack-based buffer overflow in MediaTek products - CVE-2025-20747

Vulnerability identifier: #VU117909

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-20747

CWE-ID: CWE-121

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to an incorrect bounds check within gnss. A local application can perform service disruption.

MT6986
MT8893
MT8755
MT8678
MT8676
MT6991
MT6990
MT6989
MT6986D
MT2718
MT6985
MT6982
MT6899
MT6897
MT6886
MT6878
MT6835
MT2737
TB373FU Lenovo Idea Tab Pro
TB311FU/TB311XU Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case
TB351FU Lenovo Tab Plus
TB350FU, TB350XU Lenovo Tab P11 Gen
TB350FU, TB350XU Lenovo Tab P11 2nd
TB305FUXU Lenovo Tab One/Lenovo Tab K9
TB330FUP, TB330XUP Lenovo Tab K11 Edition
TB330FUP, TB330XUP Lenovo Tab K11 Enhanced
TB570FU, TB570ZU Lenovo Tab Extreme
TB330FU/TB330XU Lenovo Tab B11/Lenovo Tab M11&K11
TB336FU/TB336ZU Lenovo Idea Tab/ Lenovo Tab K11 Gen 2
Lenovo Idea Tab Pro (TB373FU)
Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case (TB311FU/TB311XU)
Lenovo Tab Plus (TB351FU)
Lenovo Tab P11 2nd Gen (TB350XU / TB350FU)
Lenovo Tab One/Lenovo Tab K9 (TB305FUXU)
Lenovo Tab K9 (TB305FU/TB305XU)
Lenovo Tab K11 (TB330FU/TB330FUP/TB330XU/TB330XUP)
Lenovo Tab Extreme (TB570ZU/TB570FU)
Lenovo Tab M11 (TB330FU/TB330XU)
Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)

Install security update from vendor's website.

• https://corp.mediatek.com/product-security-bulletin/November-2025

• Multiple vulnerabilities in MediaTek chipsets
• Multiple vulnerabilities in Lenovo Mediatek tablets