CVE-2025-20778
Published: 06 January 2026
Summary
CVE-2025-20778 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates validation of inputs including bounds checks to the display component, directly preventing the out-of-bounds write vulnerability.
Requires timely identification, reporting, and patching of flaws like the missing bounds check fixed by ALPS10184870.
Implements runtime memory protections such as stack canaries or address space randomization to mitigate exploitation of the out-of-bounds write.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via out-of-bounds write exploitation in a system component.
NVD Description
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for…
more
exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4729.
Deeper analysisAI
CVE-2025-20778 is a vulnerability in the display component of MediaTek products, stemming from a missing bounds check that enables an out-of-bounds write. This issue, tracked as Patch ID ALPS10184870 and Issue ID MSV-4729, aligns with CWE-787 (Out-of-bounds Write) and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It was published on January 6, 2026.
The vulnerability allows local escalation of privilege, exploitable by a malicious actor who has already obtained System privilege. No user interaction is required, and exploitation involves low complexity for an attacker with local access and low privileges. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially leading to full system compromise.
MediaTek's January 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/January-2026 details the patch (ALPS10184870) as the primary mitigation. Security practitioners should ensure affected devices apply this update promptly to address the bounds check deficiency.
Details
- CWE(s)