PT-2024-8963 · Mediatek · Mediatek Vdec

Published 2024-12-02 · Updated 2025-04-22 · CVE-2024-20125

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: MediaTek vdec (affected versions not specified)

Description: The issue is related to a missing bounds check in the vdec component of MediaTek microprogram software, which could lead to an out of bounds write. This could result in local escalation of privilege if a malicious actor has already obtained System privileges. User interaction is not needed for exploitation.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ASB-A-371710871

BDU:2024-10644

CVE-2024-20125

M-ALPS09046782

Affected Products

Mediatek Vdec

References · 15

• https://corp.mediatek.com/product-security-bulletin/December-2024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20125 · Security Note
• https://bdu.fstec.ru/vul/2024-10644 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20125 · Vendor Advisory
• https://twitter.com/fridaysecurity/status/1863437501848830170 · Twitter Post
• https://t.me/cvenotify/102868 · Telegram Post
• https://t.me/cvenotify/119328 · Telegram Post
• https://securityonline.info/mediatek-patches-high-severity-vulnerability-in-smartphone-chipsets-cve-2024-20125 · Note
• https://t.me/pentestingnews/53783 · Telegram Post
• https://twitter.com/CVEnew/status/1863425019889451515 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1863472594751557689 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1863436660438085747 · Twitter Post
• https://source.android.com/docs/security/bulletin/2024-12-01?hl=ru · Note
• https://reddit.com/r/k12cybersecurity/comments/1h5oefs/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/cvedetector/11747 · Telegram Post