In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Google
  • Android
Mediatek
  • Mt6835
  • Mt6835 Firmware
  • Mt6835t
  • Mt6878
  • Mt6878 Firmware
  • Mt6878m
  • Mt6878t
  • Mt6886
  • Mt6886 Firmware
  • Mt6897
  • Mt6897 Firmware
  • Mt6899
  • Mt6899 Firmware
  • Mt6980
  • Mt6980d
  • Mt6980d Firmware
  • Mt6985
  • Mt6985 Firmware
  • Mt6985t
  • Mt6989
  • Mt6989 Firmware
  • Mt6989t
  • Mt6990
  • Mt6990 Firmware
  • Mt6991
  • Mt6991 Firmware
  • Mt8676
  • Mt8676 Firmware
  • Mt8678
  • Mt8678 Firmware
  • Mt8775
  • Mt8791
  • Mt8791t
  • Mt8791t Firmware
  • Mt8796
  • Mt8796 Firmware
  • Mt8873
Openwrt
  • Openwrt
Rdkcentral
  • Rdk-b

Configuration 1 [-]

AND
OR cpe:2.3:a:rdkcentral:rdk-b:2024q1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*
cpe:2.3:o:openwrt:openwrt:23.05:*:*:*:*:*:*:*
OR cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*

No data.

References
Link Providers
https://corp.mediatek.com/product-security-bulletin/October-2025 cve-icon cve-icon
History

Tue, 21 Oct 2025 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Mediatek mt6835 Firmware
Mediatek mt6835t
Mediatek mt6878 Firmware
Mediatek mt6878m
Mediatek mt6878t
Mediatek mt6886 Firmware
Mediatek mt6897 Firmware
Mediatek mt6899 Firmware
Mediatek mt6980
Mediatek mt6980d Firmware
Mediatek mt6985 Firmware
Mediatek mt6985t
Mediatek mt6989 Firmware
Mediatek mt6989t
Mediatek mt6990 Firmware
Mediatek mt6991 Firmware
Mediatek mt8676 Firmware
Mediatek mt8678 Firmware
Mediatek mt8791
Mediatek mt8791t Firmware
Mediatek mt8796 Firmware
Vendors & Products Mediatek mt6835 Firmware
Mediatek mt6835t
Mediatek mt6878 Firmware
Mediatek mt6878m
Mediatek mt6878t
Mediatek mt6886 Firmware
Mediatek mt6897 Firmware
Mediatek mt6899 Firmware
Mediatek mt6980
Mediatek mt6980d Firmware
Mediatek mt6985 Firmware
Mediatek mt6985t
Mediatek mt6989 Firmware
Mediatek mt6989t
Mediatek mt6990 Firmware
Mediatek mt6991 Firmware
Mediatek mt8676 Firmware
Mediatek mt8678 Firmware
Mediatek mt8791
Mediatek mt8791t Firmware
Mediatek mt8796 Firmware

Wed, 15 Oct 2025 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Mediatek
Mediatek mt6835
Mediatek mt6878
Mediatek mt6886
Mediatek mt6897
Mediatek mt6899
Mediatek mt6980d
Mediatek mt6985
Mediatek mt6989
Mediatek mt6990
Mediatek mt6991
Mediatek mt8676
Mediatek mt8678
Mediatek mt8775
Mediatek mt8791t
Mediatek mt8796
Mediatek mt8873
Openwrt
Openwrt openwrt
Rdkcentral
Rdkcentral rdk-b
CPEs cpe:2.3:a:rdkcentral:rdk-b:2024q1:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6835:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*
cpe:2.3:h:mediatek:mt8873:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*
cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*
cpe:2.3:o:openwrt:openwrt:23.05:*:*:*:*:*:*:*
Vendors & Products Google
Google android
Mediatek
Mediatek mt6835
Mediatek mt6878
Mediatek mt6886
Mediatek mt6897
Mediatek mt6899
Mediatek mt6980d
Mediatek mt6985
Mediatek mt6989
Mediatek mt6990
Mediatek mt6991
Mediatek mt8676
Mediatek mt8678
Mediatek mt8775
Mediatek mt8791t
Mediatek mt8796
Mediatek mt8873
Openwrt
Openwrt openwrt
Rdkcentral
Rdkcentral rdk-b

Tue, 14 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Oct 2025 09:30:00 +0000

Type Values Removed Values Added
Description In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798.
Weaknesses CWE-190
References
cve-icon MITRE

Status: PUBLISHED

Assigner: MediaTek

Published: 2025-10-14T09:11:48.751Z

Updated: 2025-10-14T14:04:29.983Z

Reserved: 2024-11-01T01:21:50.391Z

Link: CVE-2025-20722

cve-icon Vulnrichment

Updated: 2025-10-14T13:20:20.808Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-14T10:15:37.070

Modified: 2025-10-15T18:45:07.507

Link: CVE-2025-20722

cve-icon Redhat

No data.