Critical severity · published Jun 2, 2025
CVE-2025-20672
In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412257; Issue ID: MSV-3292.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mt7902 Firmware · Mediatek
through 3.6 · source: NVD
MF
Mt7921 Firmware · Mediatek
through 3.6 · source: NVD
MF
Mt7922 Firmware · Mediatek
through 3.6 · source: NVD
MF
Mt7925 Firmware · Mediatek
through 3.6 · source: NVD
MF
Mt7927 Firmware · Mediatek
through 3.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-20672
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-20672
Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/June-2025
More from Mt7902 Firmware
7.8
CVE-2026-20495
In Bluetooth driver, there is a possible permission bypass due to a missing permission check
7.5
CVE-2022-32663
In Wi-Fi driver, there is a possible system crash due to null pointer dereference
6.7
CVE-2022-32656
In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling
6.7
CVE-2022-32655
In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling
6.7
CVE-2022-32654
In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling