CVE-2025-20779CWE-416

CVE-2025-20779

High · published January 6, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
0.3
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in the display code opens the door to privilege escalation with just the right System access! Think of this as a crowded restaurant where a waiter drops a plate of food just before a diner can grab it — if they’re quick enough, they could end up with something they shouldn’t. This vulnerability allows an attacker to exploit a moment of confusion in the system’s memory management, potentially gaining elevated privileges. With this bug, a malicious user who already has System privileges could escalate their access without needing any user interaction. Imagine a burglar already inside the building suddenly finding a hidden key that unlocks the safe — they could take everything! The results can be absolutely devastating, leading to data breaches or unauthorized control over system functions.

Put simply

Think of this as a crowded restaurant where a waiter drops a plate of food just before a diner can grab it — if they’re quick enough, they could end up with something they shouldn’t. This vulnerability allows an attacker to exploit a moment of confusion in the system’s memory management, potentially gaining elevated privileges. This vulnerability arises from a use after free condition caused by a race condition in the display component, allowing attackers to manipulate memory and gain elevated privileges without additional authentication steps.

What to do

With this bug, a malicious user who already has System privileges could escalate their access without needing any user interaction. Imagine a burglar already inside the building suddenly finding a hidden key that unlocks the safe — they could take everything! The results can be absolutely devastating, leading to data breaches or unauthorized control over system functions. To safeguard against this vulnerability, apply Patch ID ALPS10184084 immediately. Additionally, monitor for any unusual activity on systems with System privileges to catch potential exploitation attempts early. Regularly review your access control policies to minimize risks. You've got this! Stay vigilant and patch up — the internet is counting on its heroes! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00085 · 0.3th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-06T07:15Z
Affected products (3)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (1)
EPSS history
Timeline
  • 06 JAN 01:46Z
    In display, there is a possible use after free due to a race condition
    cvelistv5