CVE-2025-20749: 
NixOS vulnerability analysis and mitigation

CVE-2025-20749 is a stack-based buffer overflow (out-of-bounds write) vulnerability in the MediaTek charger component affecting Android devices. Due to a missing bounds check, a local attacker who has already obtained System-level privileges can escalate further privileges without any user interaction. The vulnerability was disclosed on November 4, 2025, and affects Android versions 14.0, 15.0, and 16.0 running on a range of MediaTek chipsets. It carries a CVSS v3.1 base score of 6.7 (Medium) (MediaTek Advisory, Red Hat CVE).

The root cause is a missing bounds check in the MediaTek charger driver component, classified as CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). An attacker exploiting this vulnerability can write data beyond the bounds of a stack buffer, potentially corrupting adjacent memory structures to achieve privilege escalation. The attack vector is local, requires high privileges (System-level access as a precondition), and has low attack complexity with no user interaction required. The patch is identified as ALPS09915493 (Issue ID: MSV-3800) (MediaTek Advisory).

Successful exploitation allows a local attacker already holding System privileges to escalate to higher privilege levels, with high impact on confidentiality, integrity, and availability of the affected device. This could enable an attacker to modify system memory, bypass security boundaries, and potentially gain deeper control over the Android system. Affected hardware includes a broad range of MediaTek chipsets: MT6855, MT6879, MT6983, MT6789, MT6835, MT6878, MT6886, MT6897, MT6899, MT6985, MT6989, MT6991, MT8169, MT8188, MT8195, MT8196, MT8781, and MT8796 (MediaTek Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires the attacker to have already obtained System-level privileges on the device, significantly limiting the attack surface (Red Hat CVE, MediaTek Advisory).

MediaTek has released a patch (Patch ID: ALPS09915493) addressed in the November 2025 MediaTek Product Security Bulletin. Users and device manufacturers should apply the latest Android security updates that incorporate this patch for affected chipsets running Android 14.0, 15.0, and 16.0. Lenovo has also issued a device-specific advisory for affected MediaTek-based tablets. As a general mitigation, organizations should restrict and monitor system-level access on Android devices and implement robust access control mechanisms (MediaTek Advisory, Lenovo Advisory).