CVE-2025-20657: Input Validation
Published Apr 7, 2025
·Updated
In vdec, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09486425; Issue ID: MSV-2609.
Affected Software
16 affected components
All of the following
Any of the following
Google Android=12.0
Google Android=15.0
Any of the following
MediaTek Mt6765
MediaTek Mt6768
MediaTek Mt6781
MediaTek Mt6789
MediaTek Mt6833
MediaTek Mt6853
MediaTek Mt6877
MediaTek Mt6885
MediaTek Mt8768
MediaTek Mt8771
MediaTek Mt8781
MediaTek Mt8786
MediaTek Mt8791t
Google Android
Event History
Apr 7, 2025
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityAffected Software
CVE Published
via MITRE·03:14 AM
Data Sourced
via MITRE·03:14 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-20657?
CVE-2025-20657 has a moderate severity level due to the potential for local privilege escalation.
2
How do I fix CVE-2025-20657?
To fix CVE-2025-20657, apply the patch identified as ALPS09486425.
3
What causes the vulnerability CVE-2025-20657?
CVE-2025-20657 is caused by improper input validation in the vdec component.
4
Is user interaction required to exploit CVE-2025-20657?
No, user interaction is not needed for exploitation of CVE-2025-20657.
5
Which software versions are affected by CVE-2025-20657?
CVE-2025-20657 affects Google Android versions 12.0 and 15.0.