CVE-2025-20806: Use After Free

Published Jan 6, 2026

Updated

In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10114835; Issue ID: MSV-4479.

Affected Software

4 affected components

All of the following

Google Android=16.0

Any of the following

MediaTek Mt6899

MediaTek Mt6991

MediaTek Mt8793

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS10114835

Event History

Jan 6, 2026

CVE Published

via MITRE·01:47 AM

Data Sourced

via MITRE·01:47 AM

DescriptionWeakness

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20806?

CVE-2025-20806 has a high severity due to its potential for local escalation of privilege.

How do I fix CVE-2025-20806?

CVE-2025-20806 can be fixed by applying Patch ID: ALPS10114835.

What type of vulnerability is CVE-2025-20806?

CVE-2025-20806 is a memory corruption vulnerability due to use after free.

Who is affected by CVE-2025-20806?

CVE-2025-20806 affects devices running Google Android version 16.0.

Is user interaction required for exploiting CVE-2025-20806?

No, user interaction is not needed for exploitation of CVE-2025-20806.