01 Record

CVE-2024-20125

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained System privileges. User

MediumPUBLISHEDCNA: MediaTek

CNA base score6.7 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained System privileges. User

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.08% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 0.2% of scored records. A rank, not a probability.

NVD base score

6.7 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Analyzed. NVD last modified this record on 2026-06-17.

Red Hat severity

No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-12-02 03:06Z1 YR AGO

Last updated

2024-12-03 04:55Z1 YR AGO

Reserved

2023-11-02

Assigning CNA

MediaTek

Record state

PUBLISHED

Severity

Medium (CVSS 6.7)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787Out-of-bounds WriteBase

Data version

5.1

Document digest

1fe98dcb21bb94c5c8c9c02542c16b9f9e19ba14a1e6ca0e3cb202d16bd8154f

05 Affected products

VendorProductVersionsPlatforms

MediaTek, Inc.MT6580, MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6873, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6983, MT6985, MT8175, MT8195, MT8321, MT8365, MT8370, MT8385, MT8390, MT8395, MT8666, MT8667, MT8673, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8791T, MT8797, MT8798Android 13.0, 14.0—

mediatekmt65800 to *—

mediatekmt67610 to *—

mediatekmt67650 to *—

mediatekmt67680 to *—

mediatekmt67790 to *—

mediatekmt67810 to *—

mediatekmt67850 to *—

mediatekmt67890 to *—

mediatekmt68330 to *—

mediatekmt68350 to *—

mediatekmt68530 to *—

mediatekmt68550 to *—

mediatekmt68730 to *—

mediatekmt68770 to *—

mediatekmt68790 to *—

mediatekmt68830 to *—

mediatekmt68850 to *—

mediatekmt68860 to *—

mediatekmt68890 to *—

mediatekmt68930 to *—

mediatekmt68950 to *—

mediatekmt69830 to *—

mediatekmt69850 to *—

mediatekmt81750 to *—

mediatekmt81950 to *—

mediatekmt83210 to *—

mediatekmt83650 to *—

mediatekmt83700 to *—

mediatekmt83850 to *—

mediatekmt83900 to *—

mediatekmt83950 to *—

mediatekmt86660 to *—

mediatekmt86670 to *—

mediatekmt86730 to *—

mediatekmt87650 to *—

mediatekmt87660 to *—

mediatekmt87680 to *—

mediatekmt87710 to *—

mediatekmt87810 to *—

mediatekmt87860 to *—

mediatekmt87880 to *—

mediatekmt8791t0 to *—

mediatekmt87970 to *—

mediatekmt87980 to *—

06 References

corp.mediatek.comhttps://corp.mediatek.com/product-security-bulletin/December-2024