MediaTek GNSS Driver CVE-2025-20723

Exploitation requires the attacker to already hold Android System privilege on the device; the description explicitly states escalation occurs only 'if a malicious actor has already obtained the System privilege.' The vulnerable component is the MediaTek gnss (GNSS/location) driver, so only Android devices built on affected MediaTek chipsets (platform listed as Android 14.0/15.0) are exposed. No user interaction is needed (UI:N) and access is local only (AV:L) - there is no remote or network-facing vector. The key limiting factor is the high pre-existing privilege prerequisite (System), which makes this a post-compromise escalation step rather than an independently exploitable entry point; this materially reduces real-world risk despite the High CVSS and full C/I/A impact.

This is a MediaTek gnss driver out-of-bounds write (CWE-787) rated CVSS 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding full confidentiality/integrity/availability impact but only via local access. The most important qualifier is self-evident from the description: exploitation requires that 'a malicious actor has already obtained the System privilege' - meaning this is a privilege-boundary bypass from Android's System context to kernel/driver level, not an initial-access bug. This creates a notable tension with the CVSS vector, which encodes PR:L (low privilege); the description implies the attacker must already hold the highly-privileged System role, which is closer to PR:H - verify privilege prerequisite with the MediaTek bulletin. Supporting signals point to low real-world urgency: EPSS is 0.09% (0th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced. There is no public exploit identified at time of analysis. Net assessment: a genuine local kernel-level escalation worth patching on affected MediaTek-based Android fleets, but it is a second-stage/post-compromise bug with no evidence of active or widespread exploitation - a routine high-severity monthly-bulletin fix rather than an emergency.

An attacker who has already gained Android System-level privileges (e.g. via a prior exploit or a malicious privileged app/service) invokes the vulnerable MediaTek gnss driver interface with crafted input that defeats an incorrect bounds check, triggering an out-of-bounds write. The memory corruption is used to escalate from the System context toward kernel/driver-level control with no user interaction. No public exploit code is referenced, so an attacker would need to develop the exploit independently.