CVE-2025-20799
Published: 06 January 2026
Summary
CVE-2025-20799 is a high-severity Use After Free (CWE-416) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the use-after-free vulnerability in c2ps by requiring timely application of patches such as ALPS10274607.
Implements memory protection mechanisms explicitly designed to mitigate use-after-free vulnerabilities leading to memory corruption.
Enforces least privilege to limit the impact of local privilege escalation from low-privilege attackers exploiting the c2ps vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free memory corruption in local system component directly enables local privilege escalation via exploitation (T1068).
NVD Description
In c2ps, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID:…
more
ALPS10274607; Issue ID: MSV-5049.
Deeper analysisAI
CVE-2025-20799 is a use-after-free vulnerability (CWE-416) in the c2ps component that can result in memory corruption. Published on 2026-01-06, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is tracked under Issue ID MSV-5049 with Patch ID ALPS10274607.
A local attacker with low privileges (PR:L) could exploit this vulnerability to achieve escalation of privilege, provided they have already obtained System privilege. No user interaction is required, allowing arbitrary execution leading to high impacts on confidentiality, integrity, and availability.
MediaTek's January 2026 product security bulletin at https://corp.mediatek.com/product-security-bulletin/January-2026 details the patch and recommended mitigations for affected systems.
Details
- CWE(s)