CVE-2025-20802: 
NixOS vulnerability analysis and mitigation

CVE-2025-20802 is a use-after-free memory corruption vulnerability in the MediaTek geniezone component that can lead to local escalation of privilege. It affects Android 15.0 running on MediaTek chipsets MT6991, MT8196, MT8367, MT8781, MT8786, and MT8793. Exploitation requires that the attacker has already obtained System-level privilege, and no user interaction is needed. The vulnerability was published on January 5–6, 2026, with a patch released in MediaTek's January 2026 security bulletin. It carries a CVSS v3.1 base score of 6.7 (Medium) (MediaTek Bulletin, Feedly).

The vulnerability is classified as CWE-416 (Use After Free) and resides in the geniezone component of MediaTek's Android firmware. A use-after-free condition occurs when memory that has been freed is subsequently accessed, potentially allowing an attacker to corrupt memory and redirect execution flow. Because geniezone is a trusted execution environment (TEE) component, exploitation from the System privilege context could allow an attacker to escalate further into privileged or kernel-level execution. The patch is identified as Patch ID ALPS10238968 / Issue ID MSV-4914 (MediaTek Bulletin).

Successful exploitation results in high confidentiality, integrity, and availability impact on the affected device. An attacker who has already achieved System privilege can leverage this vulnerability to further escalate privileges, potentially gaining control over sensitive TEE-protected data, compromising system integrity, and causing service disruption. The scope is limited to the local device, but the ability to break out of the System privilege boundary into more privileged execution contexts represents a significant risk on affected MediaTek-based Android 15.0 devices (Feedly, MediaTek Bulletin).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation is constrained by the prerequisite of System-level privilege on the target device, which significantly limits the attacker pool (Feedly).

MediaTek has released a patch (Patch ID: ALPS10238968; Issue ID: MSV-4914) addressing this vulnerability, detailed in the January 2026 MediaTek Product Security Bulletin. Users and device manufacturers should apply OTA updates incorporating this patch for affected chipsets (MT6991, MT8196, MT8367, MT8781, MT8786, MT8793) running Android 15.0. Lenovo has also published a corresponding advisory for affected MediaTek-based tablets. In the interim, organizations should enforce least-privilege principles to limit the exposure of System-level access on managed devices (MediaTek Bulletin, Lenovo Advisory).