CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2025-20645: In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a...

Description

In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09475476; Issue ID: MSV-2599.

Classification

CVE ID: CVE-2025-20645

Problem Types

CWE-787 Out-of-bounds Write

Affected Products

Vendor: MediaTek, Inc.

Product: MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT6879, MT6886, MT6893, MT6897, MT6983, MT6985, MT6989, MT8796

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.01% (probability of being exploited)

EPSS Percentile: 1.03% (scored less or equal to compared to others)

EPSS Date: 2025-03-31 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-20645
https://corp.mediatek.com/product-security-bulletin/March-2025

Timeline