What is the CVSS score of CVE-2025-20726?

CVE-2025-20726 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Lr12a are affected by CVE-2025-20726?

CVE-2025-20726 presents notable security risk, a heap-based buffer overflow vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2025-20726?

Within 30 days: Identify all affected systems and apply vendor patches as part of regular patch cycle. If patching is delayed, consider network segmentation to limit exposure.

Lr12a CVE-2025-20726

HIGH

Heap-based Buffer Overflow (CWE-122)

2025-11-04 security@mediatek.com

Buffer Overflow Heap Overflow Privilege Escalation Lr12a Nr15 Nr16 Nr17 Nr17r

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 04, 2025 - 07:15 nvd

HIGH 7.5

DescriptionCVE.org

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01672598; Issue ID: MSV-4622.

AnalysisAI

In Modem, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-122. In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01672598; Issue ID: MSV-4622. Affected products include: Mediatek Lr12A, Mediatek Nr15, Mediatek Nr16, Mediatek Nr17, Mediatek Nr17R.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.