CVE-2025-20796: Input Validation

Published Jan 6, 2026

Updated

In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10314745; Issue ID: MSV-5553.

Affected Software

4 affected components

All of the following

Google Android=15.0

Any of the following

MediaTek Mt6989

MediaTek Mt8796

MediaTek Mt8893

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS10314745

Event History

Jan 6, 2026

CVE Published

via MITRE·01:46 AM

Data Sourced

via MITRE·01:46 AM

DescriptionWeakness

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20796?

CVE-2025-20796 has a high severity level due to its potential for local escalation of privilege.

How do I fix CVE-2025-20796?

To fix CVE-2025-20796, apply the patch identified by ALPS10314745.

What causes the vulnerability identified by CVE-2025-20796?

CVE-2025-20796 is caused by improper input validation leading to possible out of bounds write.

Does CVE-2025-20796 require user interaction for exploitation?

Yes, CVE-2025-20796 requires user interaction for exploitation.

Which software versions are affected by CVE-2025-20796?

CVE-2025-20796 affects the Google Android version 15.0.