CVE-2025-20778CWE-787

CVE-2025-20778

High · published January 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.3
In the wild
Unconfirmed
What it is

⚡ Missing a crucial bounds check in display could allow a local privilege escalation without needing user interaction! Imagine the chaos this could cause! 🔥 Think of it as a restaurant where the kitchen staff don't check the orders properly — they might just serve anything, even if it's meant for another customer. In this case, the unchecked write allows bad actors to sneak in changes that shouldn't be allowed, just like a rogue chef adds weird ingredients without a second thought. This vulnerability could enable a malicious actor, already with System privileges, to escalate their access further, effectively gaining control over the system. Without user interaction, it’s like handing a kid the key to the candy store and saying, 'Go wild!' This could lead to a complete takeover of sensitive information and resources.

Put simply

Think of it as a restaurant where the kitchen staff don't check the orders properly — they might just serve anything, even if it's meant for another customer. In this case, the unchecked write allows bad actors to sneak in changes that shouldn't be allowed, just like a rogue chef adds weird ingredients without a second thought. CVE-2025-20778 involves an out of bounds write vulnerability due to a missing bounds check in the display component. If a malicious actor has System privileges, they can exploit this issue to escalate their privileges further.

What to do

This vulnerability could enable a malicious actor, already with System privileges, to escalate their access further, effectively gaining control over the system. Without user interaction, it’s like handing a kid the key to the candy store and saying, 'Go wild!' This could lead to a complete takeover of sensitive information and resources. To protect your systems, apply the patch ID ALPS10184870 immediately. Regularly audit user privileges to ensure that only necessary access is granted, and keep an eye out for any unusual system behavior after the patch is applied. You've got this! Follow these steps and you'll fortify your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00086 · 0.3th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-01-06T07:15Z
Affected products (3)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (1)
EPSS history
Timeline
  • 06 JAN 01:46Z
    In display, there is a possible out of bounds write due to a missing bounds check
    cvelistv5