CVE-2025-20650: Medium severity linuxfoundation Yocto vulnerability

Published Mar 3, 2025

Updated

In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291294; Issue ID: MSV-2061.

Affected Software

29 affected components

All of the following

Any of the following

linuxfoundation Yocto=4.0

Rdkcentral Rdk-b=2022q3

Rdkcentral Rdk-b=2024q1

Google Android=13.0

Google Android=14.0

Google Android=15.0

OpenWrt OpenWrt=21.02.0

OpenWrt OpenWrt=23.05

Any of the following

MediaTek Mt2737

MediaTek Mt6781

MediaTek Mt6789

MediaTek Mt6835

MediaTek Mt6855

MediaTek Mt6878

MediaTek Mt6879

MediaTek Mt6880

MediaTek Mt6886

MediaTek Mt6890

MediaTek Mt6895

MediaTek Mt6897

MediaTek Mt6980

MediaTek Mt6983

MediaTek Mt6985

MediaTek Mt6989

MediaTek Mt6990

MediaTek Mt8370

MediaTek Mt8390

MediaTek Mt8676

MediaTek Mt8678

Event History

Mar 3, 2025

CVE Published

via MITRE·02:25 AM

Data Sourced

via MITRE·02:25 AM

DescriptionWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20650?

CVE-2025-20650 has the potential for local escalation of privilege due to an out-of-bounds write flaw.

How do I fix CVE-2025-20650?

To mitigate CVE-2025-20650, ensure that the appropriate patches provided by the vendor are applied as soon as possible.

Who is affected by CVE-2025-20650?

CVE-2025-20650 affects several versions of Android and the Yocto Project, among others, if the specific versions are in use.

Is user interaction required for exploiting CVE-2025-20650?

Yes, user interaction is necessary to exploit CVE-2025-20650.

Can CVE-2025-20650 be exploited remotely?

No, CVE-2025-20650 requires physical access to the device for exploitation.