CVE-2025-20768: High severity Google Android vulnerability

Published Dec 2, 2025

Updated

In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.

Affected Software

28 affected components

All of the following

Any of the following

Google Android=14.0

Google Android=15.0

Google Android=16.0

Any of the following

MediaTek Mt6739

MediaTek Mt6761

MediaTek Mt6765

MediaTek Mt6768

MediaTek Mt6781

MediaTek Mt6789

MediaTek Mt6833

MediaTek Mt6835

MediaTek Mt6853

MediaTek Mt6855

MediaTek Mt6877

MediaTek Mt6878

MediaTek Mt6879

MediaTek Mt6883

MediaTek Mt6885

MediaTek Mt6886

MediaTek Mt6889

MediaTek Mt6893

MediaTek Mt6895

MediaTek Mt6897

MediaTek Mt6899

MediaTek Mt6983

MediaTek Mt6985

MediaTek Mt6989

MediaTek Mt6991

Event History

Dec 2, 2025

CVE Published

via MITRE·02:34 AM

Data Sourced

via MITRE·02:34 AM

DescriptionWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20768?

CVE-2025-20768 is considered a moderate severity vulnerability due to the potential for local escalation of privilege.

How do I fix CVE-2025-20768?

To fix CVE-2025-20768, apply the patch with ID ALPS10196993 promptly.

Who is affected by CVE-2025-20768?

CVE-2025-20768 affects users of Google Android versions 14.0, 15.0, and 16.0.

Can CVE-2025-20768 be exploited without user interaction?

Yes, CVE-2025-20768 can be exploited without user interaction, requiring only that the attacker has system privileges.

What are the potential consequences of CVE-2025-20768?

The consequences of CVE-2025-20768 include possible local escalation of privilege, allowing an attacker to gain unauthorized access to sensitive resources.