CVE-2025-20783: 
NixOS vulnerability analysis and mitigation

CVE-2025-20783 is an out-of-bounds write vulnerability in the MediaTek display subsystem that can lead to local escalation of privilege on affected Android devices. It was disclosed on January 5–6, 2026, via MediaTek's January 2026 Product Security Bulletin. The vulnerability affects Android 14.0, 15.0, and 16.0 running on a broad range of MediaTek chipsets (MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8186, MT8188, MT8196, MT8667, MT8673, MT8676, MT8678, MT8765, MT8766, MT8768, MT8771, MT8781, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8798, MT8873, MT8883). It carries a CVSS v3.1 base score of 6.7 (Medium) (MediaTek Bulletin, Feedly).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and stems from a missing bounds check in the display subsystem driver code. An attacker who has already obtained System-level privilege on the device can trigger the out-of-bounds write to corrupt adjacent memory regions, potentially enabling further privilege escalation. The attack vector is local, requires high privileges (System), and no user interaction is needed. The patch is identified as ALPS10182882 (Issue ID: MSV-4684) (MediaTek Bulletin).

Successful exploitation allows a malicious actor already holding System privilege to escalate further within the device, compromising confidentiality, integrity, and availability. The out-of-bounds write can corrupt kernel or driver memory, potentially enabling the attacker to gain higher-level access, execute arbitrary code in a privileged context, or cause device instability. The broad chipset coverage means a large number of Android 14, 15, and 16 devices from multiple OEMs could be affected (MediaTek Bulletin, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have already obtained System-level privilege on the target device, which significantly limits the attack surface (Feedly, MediaTek Bulletin).

MediaTek has released a patch (Patch ID: ALPS10182882) addressed in the January 2026 Product Security Bulletin. Device manufacturers and OEMs should integrate and distribute this patch to affected devices running Android 14.0, 15.0, and 16.0 on the listed MediaTek chipsets. As an interim measure, organizations should enforce strict access controls on System-level privileges and limit the distribution of system certificates to reduce the risk of an attacker reaching the required privilege level. Lenovo has also published a corresponding advisory for affected MediaTek-based tablet products (MediaTek Bulletin, Lenovo Advisory).