CVE-2025-20727
Published: 04 November 2025
Summary
CVE-2025-20727 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Mediatek Lr12A. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific heap buffer overflow vulnerability through timely patching as provided by MediaTek's MOLY01672601.
Requires validation of inputs from the rogue base station to prevent heap buffer overflows due to malformed or oversized data.
Implements memory protections like heap isolation and canaries that mitigate exploitation of the out-of-bounds write for privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in modem exploited remotely via rogue base station, directly leading to privilege escalation.
NVD Description
In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no…
more
additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01672601; Issue ID: MSV-4623.
Deeper analysisAI
CVE-2025-20727 is a heap buffer overflow vulnerability in the Modem component, resulting in an out-of-bounds write. It affects MediaTek products incorporating this modem software. Published on 2025-11-04T07:15:34.540, the issue is tracked under CWE-787 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by an attacker who controls a rogue base station. When user equipment (UE) connects to the rogue base station, the attacker can trigger the heap buffer overflow, leading to escalation of privilege. No additional execution privileges or user interaction are required.
MediaTek's November 2025 product security bulletin addresses the issue with Patch ID MOLY01672601 for Issue ID MSV-4623. Practitioners should consult https://corp.mediatek.com/product-security-bulletin/November-2025 for mitigation guidance and patch deployment details.
Details
- CWE(s)