MediaTek Issues Security Update to Patch Multiple Chipset Flaws

MediaTek today published its September 2025 Product Security Bulletin, disclosing and remediating a series of critical and moderate vulnerabilities in its modem and system components, with patches already delivered to OEMs for at least two months and no evidence of exploitation in the wild, according to MediaTek.

The bulletin identifies three high-severity and three medium-severity flaws evaluated under CVSS v3.1, which could allow remote or local privilege escalation and denial of service when devices connect to rogue base stations or when an attacker already holds certain privileges.

The high-severity issues include CVE-2025-20708 (out-of-bounds write in Modem) affecting over 70 chipset models such as MT6853, MT6877, MT6899, MT6980, and MT8893, with modem firmware NR15 through NR17R; CVE-2025-20703 (out-of-bounds read in Modem) and CVE-2025-20704 (out-of-bounds write in Modem) affecting similar models, though 20704 requires user interaction for exploitation.

The three medium-severity flaws—CVE-2025-20705 in monitor_hang, CVE-2025-20706 in mbrain, and CVE-2025-20707 in geniezone—could enable local privilege escalation on various Android versions and chipsets including MT6765, MT6789, MT8169, MT6989, MT8678, MT6853, MT8792, and MT8883. MediaTek notes that patches have been delivered to OEM partners and urges manufacturers to integrate them into firmware and coordinate downstream distribution, with the bulletin dated 1 September 2025.