Read the docs
TI-2025-14790 Aliases CVE-2025-20721GHSA-g978-86gj-754v

Out-of-bounds write in MediaTek MT6886, MT6897, MT6899, MT6985, MT6989, MT6991, MT8195…

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00094 0th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MediaTekMT6886, MT6897, MT6899, MT6985, MT6989, MT6991, MT8195, MT8196, MT8370, MT8390, MT8395, MT8792, MT8793IOT-v25.0 / Android 13.0, 14.0, 15.0, 16.0—No fix listedCNA
  • MT6886, MT6897, MT6899, MT6985, MT6989, MT6991, MT8195, MT8196, MT8370, MT8390, MT8395, MT8792, MT8793 VendorMediaTek Affected IOT-v25.0 / Android 13.0, 14.0, 15.0, 16.0 Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:mediatek:iot_yocto:25.0:*:*:*:*:*:*:*25.0VulnerableMediaTek
cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*13.0VulnerableGoogle
cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*14.0VulnerableGoogle
cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*15.0VulnerableGoogle
cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:*16.0VulnerableGoogle
cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
  • cpe:2.3:a:mediatek:iot_yocto:25.0:*:*:*:*:*:*:* Versions 25.0 Vulnerable ·MediaTek
  • cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Google
  • cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Google
  • cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Google
  • cpe:2.3:o:google:android:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Google
  • cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*not specified by NVDRunning onMediaTek
  • cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
  • cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-20721
  2. 2026-10-03 Alias added: GHSA-g978-86gj-754v

References

Advisory 1

  • TI-2024-13132 Out-of-bounds write in MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT8365… CVSS 3.1CRITICAL 9.8
  • TI-2023-16072 Improper input validation in MediaTek MT5221, MT6781, MT6833, MT6853, MT6853T, MT6855… CVSS 3.1HIGH 7.5
  • TI-2023-16081 Integer overflow in MediaTek MT6879, MT6886, MT6891, MT6895, MT6896, MT6983, MT6985… CVSS 3.1MEDIUM 6.7
  • TI-2023-16080 Integer overflow in MediaTek MT6771, MT6779, MT6785, MT6853, MT6853T, MT6873, MT6877… CVSS 3.1MEDIUM 6.7
  • TI-2023-16063 Improper input validation in MediaTek MT2713, MT6779, MT6781, MT6785, MT6789, MT6833… CVSS 3.1MEDIUM 6.7
  • TI-2023-16058 Out-of-bounds write in MediaTek MT6781, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875… CVSS 3.1MEDIUM 6.7
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences