CVE-2025-20746: Medium severity linuxfoundation Yocto vulnerability

Published Nov 4, 2025

Updated

In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.

Affected Software

25 affected components

All of the following

Any of the following

linuxfoundation Yocto=4.0

Rdkcentral Rdk-b=2024q1

Google Android=14.0

Google Android=15.0

OpenWrt OpenWrt=21.02.0

OpenWrt OpenWrt=23.05.0

zephyrproject zephyr=3.7.0

Any of the following

MediaTek Mt2718

MediaTek Mt2737

MediaTek Mt6835

MediaTek Mt6878

MediaTek Mt6886

MediaTek Mt6897

MediaTek Mt6899

MediaTek Mt6982

MediaTek Mt6985

MediaTek Mt6986

MediaTek Mt6986d

MediaTek Mt6989

MediaTek Mt6990

MediaTek Mt6991

MediaTek Mt8676

MediaTek Mt8678

MediaTek Mt8755

MediaTek Mt8893

Event History

Nov 4, 2025

CVE Published

via MITRE·06:20 AM

Data Sourced

via MITRE·06:20 AM

DescriptionWeakness

Data Sourced

via NVD·07:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20746?

CVE-2025-20746 is rated as a high severity vulnerability that can lead to local escalation of privilege.

How do I fix CVE-2025-20746?

To fix CVE-2025-20746, apply the patch identified as ALPS10010441.

Who is affected by CVE-2025-20746?

CVE-2025-20746 affects systems running Yocto version 4.0, RDK-B version 2024q1, Android versions 14.0 and 15.0, and OpenWrt versions 21.02.0 and 23.05.0.

Is user interaction required to exploit CVE-2025-20746?

No, user interaction is not needed for the exploitation of CVE-2025-20746.

What kind of vulnerability is CVE-2025-20746?

CVE-2025-20746 is an out of bounds write vulnerability due to an incorrect bounds check.