CVE-2025-20634 Memory corruption in MT2737, MT6813, MT6835, MT6835T, MT6878, MT6878M, MT6879, MT6886, MT6895, MT6895TT, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6983T, MT6985, MT6985T, MT6989, MT6989T, MT6990, MT6991, MT8673, MT8676, MT8678, MT8795T, MT8798, MT8863
Remote attackers can execute arbitrary code on MediaTek devices by exploiting an out-of-bounds write in the modem firmware via a rogue base station.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-20634?
CVE-2025-20634 is a high-severity memory corruption vulnerability in Mediatek Nr16, published on 3 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01289384; Issue ID: MSV-2436.
Weakness: CWE-787
Which versions are affected by CVE-2025-20634?
It affects 3 products.
Products include Mediatek Nr16, Mediatek Nr17, Mediatek Nr17r.
How do I fix CVE-2025-20634?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-20634 being exploited?
There is no known exploitation of CVE-2025-20634 in the wild and no public exploit code.
Other vulnerabilities in Mediatek Nr16
- CVE-2024-20067 Memory corruption in MT6813, MT6815, MT6835, MT6878, MT6897, MT6899, MT6986, MT6986D, MT6991, MT8792
- CVE-2024-20066 Memory corruption in MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT6895, MT6895T, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6986, MT6986D, MT6990, MT6991, MT8673, MT8792, MT8798
- CVE-2024-20151 Memory corruption in MT2737, MT2739, MT6789, MT6813, MT6815, MT6835, MT6835T, MT6855, MT6878, MT6878T, MT6879, MT6886, MT6895, MT6895T, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT8676, MT8678, MT8798, MT8863
- CVE-2024-20131 Memory corruption in MT2737, MT2739, MT6789, MT6813, MT6815, MT6835, MT6835T, MT6855, MT6878, MT6878T, MT6879, MT6886, MT6895, MT6895T, MT6896, MT6897, MT6899, MT6980, MT6980D, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT8673, MT8676, MT8795T, MT8798
- CVE-2024-20132 Memory corruption in MT2737, MT6298, MT6879, MT6886, MT6895, MT6895T, MT6896, MT6980, MT6980D, MT6983, MT6985, MT6989, MT6990, MT8673, MT8676, MT8795T, MT8798
Sources
Also known as A-381773169, ASB-A-381773169, GHSA-q7vj-9wm2-wvxr, M-MOLY01289384.