CVE-2025-20638 | Vulnetix

CVE-2025-20638 PUBLISHED CVSS 4.599999904632568 MEDIUM

In DA, there is a possible read of uninitialized heap data due to uninitialized data. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09291449; Issue ID: MSV-2066.

EPSS 0.10% · 0.9th percentile

Risk Scores

CVSS 3.1

4.599999904632568

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

0.10%

0.9th percentile

Affected Products

Vendor	Product	Versions
google	android	12.0, 13.0, 14.0
MediaTek, Inc.	MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT8167, MT8167S, MT8175, MT8185, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8395, MT8666, MT8667, MT8673, MT8675, MT8678, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8795T, MT8797, MT8798, MT8893	Android 12.0, 13.0, 14.0, 15.0

Timeline

Nov 1, 2024 CVE ID Reserved
Feb 3, 2025 EPSS Score
Feb 3, 2025 CVE Published
Feb 3, 2025 PoC Published
Feb 3, 2025 PoC Published
Feb 3, 2025 CVE Updated
Feb 18, 2025 EPSS Score
Mar 5, 2025 EPSS Score
Mar 11, 2025 Coalition ESS Score
Mar 20, 2025 EPSS Score
Apr 4, 2025 EPSS Score
Apr 18, 2025 EPSS Score

References

Open in Interactive Console →