CVE-2025-20779: 
NixOS vulnerability analysis and mitigation

CVE-2025-20779 is a use-after-free vulnerability in the MediaTek display component caused by a race condition, enabling local escalation of privilege on affected Android devices. It affects Android versions 14.0, 15.0, and 16.0 running on a broad range of MediaTek chipsets (MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8186, MT8188, MT8196, MT8667, MT8673, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8798, MT8873, MT8883). The vulnerability was disclosed on January 5–6, 2026, with a patch published in the MediaTek January 2026 Security Bulletin. It carries a CVSS v3.1 base score of 7.0 (High) (MediaTek Advisory, Feedly).

The root cause is a use-after-free condition (CWE-416) in the Android display driver component of MediaTek chipsets, triggered by a race condition during concurrent memory operations. An attacker who has already obtained System-level privilege on the device can exploit the race window to access freed memory, potentially redirecting execution flow to attacker-controlled code. The attack vector is local, requires low privileges (System privilege as a precondition), has high attack complexity due to the race condition timing requirement, and does not require user interaction. The patch is identified as ALPS10184084 (Issue ID: MSV-4720) (MediaTek Advisory, Feedly).

Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected device. An attacker who already holds System privilege can leverage this vulnerability to further escalate privileges beyond the System level, potentially gaining deeper kernel or hardware access. This could enable persistent compromise, access to sensitive user data, and disruption of device functionality across the wide range of affected MediaTek-powered Android devices (MediaTek Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. The high attack complexity (race condition timing) and the requirement for pre-existing System privilege further limit practical exploitability (Feedly, MediaTek Advisory).

MediaTek has released a patch (Patch ID: ALPS10184084; Issue ID: MSV-4720) as part of the January 2026 MediaTek Product Security Bulletin. Device manufacturers and OEMs should integrate and distribute this patch to affected devices running Android 14.0, 15.0, and 16.0 on the listed MediaTek chipsets. Lenovo has also published a corresponding advisory for affected tablet products. No configuration-based workaround is available; applying the vendor patch is the only remediation (MediaTek Advisory, Lenovo Advisory).

Security news outlet SecurityOnline.info covered the January 2026 MediaTek security bulletin, noting it as a major security overhaul for mobile chipsets. Lenovo published a dedicated advisory for its tablet products affected by this and related MediaTek vulnerabilities. No notable individual researcher commentary or significant social media discussion has been observed for this specific CVE (SecurityOnline, Lenovo Advisory).