CVE-2025-20789: 
NixOS vulnerability analysis and mitigation

CVE-2025-20789 is a local information disclosure vulnerability in the GPU PDMA (Peripheral DMA) component of MediaTek chipsets, caused by a missing bounds check. It affects Android 15.0 on MediaTek SoCs including MT6781, MT6833, MT6853, MT6877, MT6893, and MT8196. The vulnerability was disclosed on December 2, 2025, as part of MediaTek's December 2025 Product Security Bulletin (Patch ID: ALPS10117741; Issue ID: MSV-4538). It carries a CVSS v3.1 base score of 4.4 (Medium) (MediaTek Bulletin, Red Hat CVE).

The root cause is a missing bounds check in the GPU PDMA subsystem of affected MediaTek chipsets, classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The attack vector is local, requiring no elevated privileges but necessitating user interaction to trigger the vulnerable code path. An attacker who can induce a user to perform a specific action could cause the GPU PDMA component to expose memory contents beyond intended boundaries, leaking sensitive information (MediaTek Bulletin).

Successful exploitation leads to local information disclosure on affected Android 15.0 devices running vulnerable MediaTek chipsets. The confidentiality impact is low and integrity impact is low, with no availability impact; the vulnerability does not enable privilege escalation or remote code execution. The scope is limited to the local device, with no evidence of lateral movement potential (MediaTek Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.019% (0.000190), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and user interaction, significantly limiting the attack surface (MediaTek Bulletin).

MediaTek has released a patch (Patch ID: ALPS10117741) addressed in the December 2025 security bulletin. Users should apply the latest Android security updates for their devices, ensuring the December 2025 or later MediaTek security patch level is applied. Lenovo has also issued a corresponding advisory for affected MediaTek-based tablets (MediaTek Bulletin, Lenovo Advisory). As a general precaution, users should avoid interacting with untrusted applications or content on affected devices until patched.