CVE-2025-20796CWE-1285

CVE-2025-20796

High · published January 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
0.2
In the wild
Unconfirmed
What it is

⚡ A sneaky out-of-bounds write could allow local privilege escalation if an attacker already holds system privileges — like a contractor accidentally knocking down a load-bearing wall! 💥 Think of it as a kitchen where a chef accidentally spills a secret ingredient, leading to something potentially disastrous for the dish — except in this case, the dish is your entire system's security! If exploited, an attacker could gain unauthorized control, potentially allowing them to manipulate system functions or access sensitive data. This is particularly alarming since user interaction is needed, meaning just a little slip could lead to significant consequences!

Put simply

Think of it as a kitchen where a chef accidentally spills a secret ingredient, leading to something potentially disastrous for the dish — except in this case, the dish is your entire system's security! This vulnerability arises from improper input validation in imgsys, allowing an attacker to perform an out-of-bounds write that escalates privileges locally if they’ve already obtained system access. User interaction is required for the exploitation to occur, making it a bit tricky, yet still concerning.

What to do

If exploited, an attacker could gain unauthorized control, potentially allowing them to manipulate system functions or access sensitive data. This is particularly alarming since user interaction is needed, meaning just a little slip could lead to significant consequences! To protect yourself, patch immediately with ID ALPS10314745. Ensure that your input validation processes are robust, and regularly audit your systems for any suspicious activity that might indicate privilege escalation attempts. You've got this! By applying the patch and tightening your security, you can keep your systems safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00080 · 0.2th percentile
Weakness
CWE-1285 · Improper Validation of Specified Index, Position, or Offset in Input
Published
2026-01-06T07:15Z
Affected products (1)
ProductVersionsFixed in
google/androidall versions—
References (1)
EPSS history
Timeline
  • 06 JAN 01:46Z
    In imgsys, there is a possible out of bounds write due to improper input validation
    cvelistv5