CVE-2025-20658
Medium
Description
In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09474894; Issue ID: MSV-2597.
SeverityMedium
CVSS6.0
Exploit probability—
Product
Google Android
PublishedApr 7, 2025
First seenApr 7, 2025
Weakness typeCWE-787Out-of-bounds write
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google android | 12.0, 13.0, 14.0, 15.0 | — |
| mediatek mt2718 | No range specified | — |
| mediatek mt6781 | No range specified | — |
| mediatek mt6789 | No range specified | — |
| mediatek mt6835 | No range specified | — |
| mediatek mt6855 | No range specified | — |
| mediatek mt6878 | No range specified | — |
| mediatek mt6879 | No range specified | — |
| mediatek mt6886 | No range specified | — |
| mediatek mt6895 | No range specified | — |
| mediatek mt6897 | No range specified | — |
| mediatek mt6983 | No range specified | — |
| mediatek mt6985 | No range specified | — |
| mediatek mt6989 | No range specified | — |
| mediatek mt8196 | No range specified | — |
| mediatek mt8673 | No range specified | — |
| mediatek mt8676 | No range specified | — |
| mediatek mt8678 | No range specified | — |
| mediatek mt8781 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.