CVE-2025-20764: 
NixOS vulnerability analysis and mitigation

CVE-2025-20764 is an out-of-bounds write vulnerability in the MediaTek SMI (System Memory Interface) component caused by a missing bounds check. It affects Android versions 14.0, 15.0, and 16.0 running on a wide range of MediaTek chipsets including MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8196, MT8676, MT8678, MT8792, MT8793, MT8796, MT8873, and MT8893. The vulnerability was published on December 2, 2025, with a patch released in MediaTek's December 2025 Product Security Bulletin (Patch ID: ALPS10259774; Issue ID: MSV-5029). It carries a CVSS v3.1 base score of 7.8 (High) (MediaTek Advisory, Red Hat CVE).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and resides in the SMI (System Memory Interface) driver component of MediaTek-based Android devices. Due to a missing bounds check, a local attacker who has already obtained System-level privileges can trigger an out-of-bounds write operation, potentially allowing further privilege escalation. The attack vector is local, requires low privileges (System-level access as a precondition), and no user interaction is needed. No public proof-of-concept or detailed technical write-up has been identified at this time (MediaTek Advisory).

Successful exploitation could lead to local escalation of privilege beyond the System privilege level, with high impact on confidentiality, integrity, and availability of the affected device. An attacker could potentially execute arbitrary code in a more privileged context, access sensitive system data, or destabilize the device. The scope is limited to the affected device (unchanged scope), but the combination of high CIA impact makes this a significant risk for compromised MediaTek-based Android devices (MediaTek Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE. Exploitation requires the attacker to have already obtained System-level privileges on the target device, which significantly limits the attack surface (MediaTek Advisory).

MediaTek has released a patch (Patch ID: ALPS10259774) as part of its December 2025 Product Security Bulletin. Affected users should apply the latest OEM security updates that incorporate this patch for Android 14.0, 15.0, and 16.0 on affected chipsets. Lenovo has also published a corresponding advisory for affected MediaTek-based tablets. As interim measures, organizations should restrict and monitor system-level access, enforce least-privilege principles, and audit system privilege assignments on affected devices (MediaTek Advisory, Lenovo Advisory).