CVE-2025-20740 Race condition in MT7902, MT7920, MT7921, MT7922, MT7925, MT7927

Medium 4.7 Published 4 Nov 2025 Updated 4 Nov 2025

A race condition in the MediaTek Wi-Fi STA driver allows local attackers to read out-of-bounds memory, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20740?

CVE-2025-20740 is a medium-severity vulnerability in Mediatek Software Development Kit, published on 4 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In wlan STA driver, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435337; Issue ID: MSV-4036.

Weakness: CWE-367

Which versions are affected by CVE-2025-20740?

It affects 1 product.

Products include Mediatek Software Development Kit.

How do I fix CVE-2025-20740?

No fix has been published for CVE-2025-20740 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-20740 being exploited?

There is no known exploitation of CVE-2025-20740 in the wild and no public exploit code.

All Mediatek Software Development Kit vulnerabilities

Sources

Also known as GHSA-g76h-fppr-42rm.