CVE-2025-20780: 
NixOS vulnerability analysis and mitigation

CVE-2025-20780 is a use-after-free memory corruption vulnerability in the display component of MediaTek chipsets running Android 15.0 and 16.0. It was disclosed on January 5–6, 2026, via the MediaTek January 2026 Security Bulletin. The vulnerability affects over 40 MediaTek chipsets, including MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8186, MT8188, MT8196, MT8667, MT8673, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8798, MT8873, and MT8883. It carries a CVSS v3.1 base score of 7.8 (High) (MediaTek Bulletin, Feedly).

The vulnerability is classified as CWE-416 (Use After Free), occurring in the display subsystem of MediaTek's Android firmware. A use-after-free condition arises when memory that has already been freed is subsequently accessed, enabling an attacker to corrupt memory and potentially redirect code execution. Exploitation requires local access with at least low-level privileges; however, the official advisory notes that a malicious actor must have already obtained System-level privilege to leverage this for further escalation. No user interaction is required for exploitation. The patch is identified as ALPS10184061 (Issue ID: MSV-4712) (MediaTek Bulletin).

Successful exploitation leads to local privilege escalation with high impact across confidentiality, integrity, and availability. An attacker who has already obtained System privileges on an affected Android device could exploit this memory corruption to further escalate access, execute arbitrary code in a privileged context, or destabilize system functionality. The broad chipset coverage — spanning budget to flagship MediaTek SoCs — means a wide range of Android smartphones and tablets are potentially affected (MediaTek Bulletin, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of near-term exploitation. Exploitation is constrained by the prerequisite that the attacker must already possess System-level privileges on the target device (Feedly).

MediaTek released a patch (ID: ALPS10184061) as part of the January 2026 Security Bulletin, published January 8, 2026. Device manufacturers and OEMs should integrate and distribute the patched firmware to affected Android 15.0 and 16.0 devices. Lenovo has also published a corresponding advisory for affected MediaTek-based tablets. Users should apply OTA security updates as soon as they become available from their device vendor, and monitor for suspicious privilege escalation activity on affected devices (MediaTek Bulletin, Lenovo Advisory).

Security news outlet SecurityOnline.info covered the MediaTek January 2026 security overhaul, noting the breadth of chipsets affected. The Hacker Wire also reported on the vulnerability via social media posts on Mastodon and Bluesky. No significant researcher commentary or vendor statements beyond the official MediaTek bulletin have been identified (SecurityOnline).