What is the CVSS score of CVE-2025-20721?

CVE-2025-20721 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-20721?

Within 24 hours, inventory all MediaTek-based Android 13, 14, 15, and 16 devices and MediaTek IoT Yocto 25.0 deployments; confirm chipset exposure with OEM/asset data; restrict local System-level privilege and review processes that grant it; and monitor vendor channels for the referenced MediaTek patch ALPS10089545/MSV-4279. Within 7 days, enforce least privilege to reduce the prerequisite System access, monitor for anomalous kernel privilege escalation or imgsensor driver abuse, isolate affected IoT systems where feasible, and validate whether OEM firmware updates or configuration mitigations are available. Within 30 days, deploy vendor/OEM patches when released for Android 13-16 and Yocto 25.0, reimage or replace devices that cannot be patched, and maintain heightened logging and detection until remediation is complete. No vendor-released patch identified at time of analysis.

MediaTek imgsensor CVE-2025-20721

HIGH

Out-of-bounds Write (CWE-787)

2025-10-14 security@mediatek.com

Privilege Escalation Buffer Overflow Google Memory Corruption Mediatek Iot Yocto

7.8

CVSS 3.1 · Vendor: mediatek

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain System privilege on device
Delivery

Invoke imgsensor driver interface
Exploit

Trigger missing bounds check (OOB write)
Execution

Corrupt kernel memory
Impact

Escalate to kernel-level privilege

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the attacker to already possess System privilege on the device and to have local access to invoke the MediaTek imgsensor kernel driver - these are the explicit prerequisites stated in the advisory. No user interaction is needed once System access is held. The requirement for pre-existing System privilege is the primary limiting factor and dramatically narrows realistic attackers to already-privileged or chained-exploit scenarios; the flaw is not remotely reachable and does not apply to default unprivileged app contexts. Affected platforms are MediaTek-based Android 13, 14, 15, 16 and IoT Yocto 25.0.
Impact	This is a high-CVSS (7.8) but comparatively low real-world-priority local privilege escalation in MediaTek's imgsensor driver. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates purely local attack surface with low complexity and no user interaction, yielding full confidentiality/integrity/availability impact on the kernel. Crucially, the description states exploitation is only possible 'if a malicious actor has already obtained the System privilege' - this is a HIGH pre-condition that conflicts with the vendor's PR:L rating; System-level access on Android is a privileged position far above a normal app/user, so the practical privilege bar is higher than PR:L implies (verify with vendor - likely PR:H). EPSS is effectively 0.09% (0th percentile), there is no CISA KEV listing and no public exploit identified, so all signals point to this being a defense-in-depth kernel hardening fix rather than an actively weaponized bug. Overall: real but low urgency - patch in normal Android/MediaTek bulletin cadence rather than as an emergency.
Exploit ScenarioDerived	A malicious or compromised component already running with System privilege on a MediaTek-based Android device invokes the vulnerable imgsensor driver path with crafted parameters, triggering an out-of-bounds write (CWE-787) in the kernel. By corrupting kernel memory it escalates from System to full kernel/root-equivalent control. No user interaction is required, but the attacker must first hold System privilege, and no public proof-of-concept is known at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

An out-of-bounds write in MediaTek's imgsensor kernel driver (MediaTek patch ALPS10089545, issue MSV-4279) lets a local attacker who already holds System privilege on a MediaTek-based device corrupt kernel memory and escalate to full kernel/root-level control. The affected platforms are MediaTek-based Android 13, 14, 15 and 16 builds plus MediaTek IoT Yocto 25.0; no user interaction is required once the prerequisite System access is held. No public exploit code has been identified at time of analysis and the EPSS score is negligible (0.09%), so this is a chained-exploit or already-privileged-attacker scenario rather than a remotely reachable bug.

RemediationAI

The primary fix is to install an OEM firmware/OTA build that incorporates MediaTek patch ALPS10089545 (issue MSV-4279); MediaTek distributes the fix to device makers rather than end users, so the actionable step is to check the October 2025 Product Security Bulletin (https://corp.mediatek.com/product-security-bulletin/October-2025) and take the latest update from the handset or IoT vendor. No standalone vendor-released version number is published beyond the patch ID, so verify coverage with the OEM rather than assuming a generic Android security patch level includes it. Until an updated build is deployed, note that exploitation already requires pre-existing System privilege, so the practical compensating measures are to raise the cost of obtaining that privilege and shrink the attack surface: keep SELinux enforcing, disable adb/root and developer options on managed fleets, and restrict access to camera/imgsensor control interfaces to privileged system daemons only - accepting that locking down camera ioctls can break camera functionality for non-privileged apps and that none of these controls removes the underlying memory-safety flaw.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

MediaTek's imgsensor is the kernel-mode driver that manages camera image sensor configuration on MediaTek SoCs and exposes control interfaces to userspace, typically through ioctl-style commands carrying sensor parameters. The root cause is CWE-787 (out-of-bounds write) arising from a missing bounds check on a supplied length/index, so an attacker who can reach the driver can write past the end of an allocated buffer, corrupting adjacent kernel memory and potentially achieving arbitrary kernel code execution or credential/privilege modification. CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is the NVD vector, while the assessed vector is PR:H - i.e., the attacker must already possess System privilege and local access before the driver can be abused, which is the dominant practical limitation and confines this to privilege-escalation chains. The affected CPEs tie the flaw to Google Android 13.0, 14.0, 15.0 and 16.0 and to MediaTek IoT Yocto 25.0, confirming it is a platform-level driver issue in MediaTek silicon rather than a generic Android framework bug.

Know when Iot Yocto gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mediatek) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 6.7 MEDIUM

Local-only kernel driver with no user interaction; the description requires pre-existing System privilege, so PR:H rather than the vendor's PR:L; full C/I/A impact from kernel OOB write.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mediatek).

CVSS VectorVendor: mediatek

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.

Executive ViewAI

Why It Matters

MediaTek-based Android 13, 14, 15, and 16 devices and MediaTek IoT Yocto 25.0 are affected by a high-severity kernel out-of-bounds write in the imgsensor driver. A local attacker who already holds System privilege can corrupt kernel memory and escalate to root/kernel-level control, creating risk of persistent device compromise and data exposure across managed mobile and IoT fleets. No public exploit has been identified at time of analysis and EPSS is negligible, but no vendor-released patch is identified, so leadership should prioritize inventory, privilege reduction, and vendor engagement.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include strict least-privilege enforcement to prevent acquisition of System privilege, limiting local access and local attack surface, monitoring for privilege-escalation attempts, isolating affected MediaTek IoT Yocto 25.0 devices, and applying OEM/vendor mitigations as they become available.

Threat Intelligence Overview

EPSS Score

0.1%

Top 100% exploitable

Prevalence

High

MediaTek imgsensor driver ships in a large share of Android phones/IoT devices

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.