CVE-2025-20656: Medium severity linuxfoundation Yocto vulnerability

Published Apr 7, 2025

Updated

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09625423; Issue ID: MSV-3033.

Affected Software

25 affected components

All of the following

Any of the following

linuxfoundation Yocto=4.0

Rdkcentral Rdk-b=2024q1

Google Android=12.0

Google Android=13.0

Google Android=14.0

Google Android=15.0

OpenWrt OpenWrt=21.02.0

OpenWrt OpenWrt=23.05

Any of the following

MediaTek Mt6781

MediaTek Mt6789

MediaTek Mt6835

MediaTek Mt6855

MediaTek Mt6878

MediaTek Mt6879

MediaTek Mt6886

MediaTek Mt6895

MediaTek Mt6897

MediaTek Mt6983

MediaTek Mt6985

MediaTek Mt6989

MediaTek Mt6990

MediaTek Mt8196

MediaTek Mt8370

MediaTek Mt8390

Google Android

Event History

Apr 7, 2025

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

CVE Published

via MITRE·03:14 AM

Data Sourced

via MITRE·03:14 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2025-20656?

CVE-2025-20656 is classified as a high severity vulnerability due to its potential for local escalation of privilege.

How do I fix CVE-2025-20656?

To fix CVE-2025-20656, apply the patch identified as ALPS09625423 as soon as possible.

Who is affected by CVE-2025-20656?

CVE-2025-20656 affects devices running specified versions of Yocto, Android, OpenWRT, and certain MediaTek chipsets.

What type of vulnerability is CVE-2025-20656?

CVE-2025-20656 is an out-of-bounds write vulnerability due to a missing bounds check.

Is user interaction required to exploit CVE-2025-20656?

No, user interaction is not needed to exploit CVE-2025-20656, making it particularly dangerous.