CVE-2025-20798
Published: 06 January 2026
Summary
CVE-2025-20798 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements the missing bounds check on inputs to the battery component, preventing the out-of-bounds write exploitation.
Ensures timely patching of the specific flaw (ALPS10315812) to remediate the bounds check deficiency in the battery component.
Provides memory protection safeguards that mitigate unauthorized out-of-bounds writes and subsequent privilege escalation even if the flaw is present.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in local battery component directly enables local privilege escalation via memory corruption when System-level access is already present.
NVD Description
In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for…
more
exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5533.
Deeper analysisAI
CVE-2025-20798 is a vulnerability in the battery component featuring a possible out-of-bounds write due to a missing bounds check. It affects MediaTek products, as indicated by the associated Patch ID ALPS10315812 and Issue ID MSV-5533. The issue has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-787 (Out-of-bounds Write). The vulnerability was published on 2026-01-06.
A local attacker who has already obtained System privilege can exploit this vulnerability without user interaction. Exploitation involves triggering the out-of-bounds write, potentially leading to local escalation of privilege with high impacts on confidentiality, integrity, and availability.
MediaTek's January 2026 Product Security Bulletin at https://corp.mediatek.com/product-security-bulletin/January-2026 details the patch ALPS10315812 as the mitigation, recommending affected parties apply it to address the bounds check deficiency.
Details
- CWE(s)