CVE-2025-20768CWE-125

CVE-2025-20768

High · published December 2, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.3
In the wild
Unconfirmed
What it is

⚡ This vulnerability opens the door to local privilege escalation without requiring user interaction, meaning a malicious actor can exploit it once they have system privileges! Think of it like a locked door in an office that only privileged personnel can access. However, if the door’s frame is flimsy and doesn’t close properly, another employee could sneak in and access sensitive areas without anyone noticing! If exploited, this out-of-bounds read could allow an attacker to elevate their privileges, potentially giving them full control over the system. This could lead to unauthorized data access, manipulation, or even full system compromises—all without needing you to click anything! Absolutely devastating for anyone reliant on system security.

Put simply

Think of it like a locked door in an office that only privileged personnel can access. However, if the door’s frame is flimsy and doesn’t close properly, another employee could sneak in and access sensitive areas without anyone noticing! This vulnerability arises from a missing bounds check in the display component, allowing an attacker with existing system privileges to read memory locations that should be restricted. It’s a serious oversight that can lead to local privilege escalation.

What to do

If exploited, this out-of-bounds read could allow an attacker to elevate their privileges, potentially giving them full control over the system. This could lead to unauthorized data access, manipulation, or even full system compromises—all without needing you to click anything! Absolutely devastating for anyone reliant on system security. To mitigate this risk, patch your systems immediately using Patch ID ALPS10196993. Ensure you review your security policies and limit access to system privileges only to trusted personnel. Regular audits can help catch these issues early! You've got this! Follow these steps to lock down your system and keep those malicious actors at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00086 · 0.3th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-12-02T08:16Z
Affected products (3)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (1)
EPSS history
Timeline
  • 02 DEC 02:34Z
    In display, there is a possible out of bounds read due to a missing bounds check
    cvelistv5