CVE-2025-20740

Published: Nov 4, 2025Modified: Nov 5, 2025

4.7

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.0 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In wlan STA driver, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435337; Issue ID: MSV-4036.

Affected (1)

Products: Mediatek: Software Development Kit

Mediatek

1 product

Software Development Kit

Configuration A

1 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Mediatek Software Development Kit	Up to 3.7

Running on/with	Platform Versions
Mediatek Mt7902	All versions
Mediatek Mt7920	All versions
Mediatek Mt7921	All versions
Mediatek Mt7922	All versions
Mediatek Mt7925	All versions
Mediatek Mt7927	All versions

Related CWEs

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (1)

https://corp.mediatek.com/product-security-bulletin/November-2025

Source: security@mediatek.com

Vendor Advisory

Timeline

No history available yet.