MediaTek GNSS Driver CVE-2025-20722

Exploitation requires the attacker to ALREADY hold the Android System privilege (the description explicitly states 'if a malicious actor has already obtained the System privilege'), and to supply crafted input to the MediaTek GNSS (satellite positioning) driver that triggers the CWE-190 integer overflow in a bounds calculation, producing the out-of-bounds read. No user interaction is required (UI:N) and attack complexity is low (AC:L). The dominant LIMITING factor is the pre-existing System-privilege prerequisite, which already represents a near-total compromise of the device; access is local only (AV:L) with no remote vector, and impact is limited to reading memory (confidentiality) with no integrity or availability effect. Only devices using the affected MediaTek GNSS driver (as integrated into Android 14/15, OpenWrt, and RDK-B builds per the CPEs) are exposed.

This is a genuinely low-priority issue despite a MEDIUM 5.5 CVSS score, because exploitation is gated behind a very high bar. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a local, low-complexity, no-interaction attack with high confidentiality impact but no integrity or availability impact - purely an information-disclosure read. Critically, the description states the attacker must have 'already obtained the System privilege,' which is the most powerful privilege level on Android; this contradicts the vector's PR:L and is better represented as PR:H, meaning the attacker is already highly privileged before this bug yields any value. All exploitation signals point the same direction: EPSS is 0.09% (0th percentile, i.e. negligible predicted exploitation), there is no CISA KEV listing, and no public exploit code was identified. There is no SSVC decision data provided. Net: no public exploit identified at time of analysis, no active exploitation, and a self-defeating precondition (System access already held) make this a low real-world risk that should be patched during normal maintenance rather than prioritized. NOTE THE CONFLICT: the vendor-supplied PR:L understates the description's 'System privilege' requirement - verify privilege model with MediaTek.

A malicious app or process that has already escalated to the Android System privilege triggers the integer overflow in the MediaTek GNSS driver, causing an out-of-bounds read that leaks adjacent kernel/driver memory contents back to the attacker. No user interaction is required. No public proof-of-concept exists, and because the attacker must already hold System privilege, this serves mainly to extend an existing compromise rather than to gain initial access.