CVE-2025-20795: 
NixOS vulnerability analysis and mitigation

CVE-2025-20795 is an out-of-bounds write vulnerability in MediaTek's KeyInstall component that can enable local escalation of privilege on Android devices. It affects Android versions 13.0, 14.0, 15.0, and 16.0 running on a broad range of MediaTek chipsets (including MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, and various MT8xxx series). The vulnerability was published on January 5–6, 2026, with a patch released in MediaTek's January 2026 Security Bulletin and subsequently included in the Google Android March 2026 Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (MediaTek Advisory, Android Bulletin).

The root cause is an out-of-bounds write (CWE-787) in the KeyInstall component, resulting from a missing bounds check when processing input data. An attacker who has already obtained System-level privilege on the device can trigger this memory corruption to write beyond the bounds of an allocated buffer, potentially overwriting adjacent memory structures. The attack vector is local, requires low privileges (System privilege as a precondition), and no user interaction is needed. No public proof-of-concept exploit code has been identified at this time (MediaTek Advisory, Android Bulletin).

Successful exploitation allows a local attacker who already holds System privilege to further escalate privileges, potentially achieving full device compromise with high impact to confidentiality, integrity, and availability. The attacker could read and modify arbitrary memory, execute arbitrary code at an elevated privilege level, and potentially bypass Android security boundaries. The broad scope of affected MediaTek chipsets means a large number of Android devices across multiple OEMs (including Samsung and Lenovo tablets) are potentially at risk (MediaTek Advisory, Lenovo Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept for CVE-2025-20795. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have already obtained System-level privilege on the target device, which significantly limits the practical attack surface (MediaTek Advisory, Android Bulletin).

MediaTek released a patch (Patch ID: ALPS10276761) in the January 2026 MediaTek Product Security Bulletin. The fix was subsequently incorporated into the Google Android Security Bulletin for March 2026 (patch level 2026-03-01). Device owners should apply the latest available security updates from their OEM (e.g., Samsung, Lenovo) that include the January 2026 MediaTek fixes or the March 2026 Android security patch level. Where patching is not immediately possible, restricting local access to affected devices and limiting the installation of untrusted applications reduces exposure (MediaTek Advisory, Android Bulletin, Lenovo Advisory).

Security news outlets such as SecurityOnline.info covered MediaTek's January 2026 security bulletin as a "major security overhaul for mobile chipsets," noting the breadth of affected chipsets. The Hacker Wire shared updates on social platforms (Mastodon and Bluesky) highlighting the vulnerability. CIS issued an advisory noting multiple vulnerabilities in Google Android OS. Community reaction has been relatively muted given the lack of public PoC or active exploitation (SecurityOnline, CIS Advisory).