CVE-2025-20781
Published: 06 January 2026
Summary
CVE-2025-20781 is a high-severity Double Free (CWE-415) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Implements memory protection mechanisms such as ASLR, DEP, and stack canaries that directly prevent exploitation of use-after-free vulnerabilities in the display component.
Requires timely remediation of identified flaws like this MediaTek display use-after-free vulnerability through patching (ALPS10182914).
Provides process isolation for the display subsystem to contain memory corruption and limit local privilege escalation from System privilege.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via memory corruption/use-after-free in a privileged display subsystem component.
NVD Description
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID:…
more
ALPS10182914; Issue ID: MSV-4699.
Deeper analysisAI
CVE-2025-20781 is a memory corruption vulnerability stemming from a use-after-free error (CWE-415, CWE-416) in the display component of MediaTek products. This flaw affects devices utilizing MediaTek chipsets, particularly those running platforms like ALPS, as indicated by the associated Patch ID ALPS10182914 and Issue ID MSV-4699. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), highlighting its potential for significant impact with relatively low complexity.
A local attacker with low privileges (PR:L) can exploit this issue without user interaction to achieve escalation of privilege. Specifically, the description notes that exploitation is feasible if the malicious actor has already obtained System privilege, enabling arbitrary code execution or further compromise through memory corruption in the display subsystem.
MediaTek's January 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/January-2026 details the patch (ALPS10182914) to address this vulnerability. Security practitioners should prioritize applying this update to affected MediaTek-based devices to mitigate the risk of local privilege escalation.
Details
- CWE(s)