CVE-2025-20781CWE-415CWE-416

CVE-2025-20781

High · published January 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

🚨 A memory corruption issue lurking in the display could let a crafty hacker escalate their privileges—no user interaction needed! ⚡️ Think of this like a restaurant where the chef mistakenly throws out a completed order but forgets to inform the waiter. The waiter might then serve a dish that’s technically done but still left in the kitchen, allowing someone who shouldn’t be in the back to sneak in and steal a meal! If an attacker has already gained system privileges, they could exploit this vulnerability to escalate their access even further, potentially gaining control over sensitive data or system functions. The impact could be absolutely devastating, allowing for unauthorized actions that can compromise the integrity of the entire system.

Put simply

Think of this like a restaurant where the chef mistakenly throws out a completed order but forgets to inform the waiter. The waiter might then serve a dish that’s technically done but still left in the kitchen, allowing someone who shouldn’t be in the back to sneak in and steal a meal! This vulnerability arises from a use-after-free error that can lead to memory corruption, allowing an attacker with system privileges to manipulate memory in unsafe ways, expanding their control over the system.

What to do

If an attacker has already gained system privileges, they could exploit this vulnerability to escalate their access even further, potentially gaining control over sensitive data or system functions. The impact could be absolutely devastating, allowing for unauthorized actions that can compromise the integrity of the entire system. To safeguard against this vulnerability, apply Patch ID ALPS10182914 immediately, and ensure your system is updated to the latest version. Regularly review permissions and restrict system access to minimize exposure to risks. 🛡️ You've got this! Follow these steps, and you'll keep your system secure and sound. 💪😄

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00080 · 0.1th percentile
Weaknesses
CWE-415 · Double Free; CWE-416 · Use After Free
Published
2026-01-06T07:15Z
Affected products (3)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (1)
EPSS history
Timeline
  • 06 JAN 01:46Z
    In display, there is a possible memory corruption due to use after free
    cvelistv5