# CVE-2025-20736: In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…

Source: https://junglewise.ai/threats/cve-2025-20736-in-wlan-ap-driver-there-is-a-possible-out-of-bounds-write-due-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-04  
License: CC BY 4.0 with a link back

CVE-2025-20736 · Severity: medium · CVSS 6.7 · Published 2025-11-04

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435347; Issue ID: MSV-4049.

Technologies: [MediaTek Mt6890](https://junglewise.ai/threats/technologies/mt6890), [MediaTek Mt7615](https://junglewise.ai/threats/technologies/mt7615), [MediaTek Mt7622](https://junglewise.ai/threats/technologies/mt7622), [MediaTek Mt7663](https://junglewise.ai/threats/technologies/mt7663), [MediaTek Mt7915](https://junglewise.ai/threats/technologies/mt7915), [MediaTek Mt7916](https://junglewise.ai/threats/technologies/mt7916), [MediaTek Mt7981](https://junglewise.ai/threats/technologies/mt7981), [MediaTek Mt7986](https://junglewise.ai/threats/technologies/mt7986), [MediaTek Software Development Kit](https://junglewise.ai/threats/technologies/software-development-kit), [OpenWrt](https://junglewise.ai/threats/technologies/openwrt). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek), [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2025-20736 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-20736 being exploited in the wild.

**How severe is CVE-2025-20736?** Medium severity, with a CVSS score of 6.7, published 4 November 2025.

**Which products and versions are affected?** MediaTek Mt6890, MediaTek Mt7615, MediaTek Mt7622, MediaTek Mt7663 and 6 more. The advisory does not name versions.

**Is there a fix for CVE-2025-20736?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-20736?** Check whether you run MediaTek Mt6890, MediaTek Mt7615, MediaTek Mt7622 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- MediaTek Mt6890
- MediaTek Mt7615
- MediaTek Mt7622
- MediaTek Mt7663
- MediaTek Mt7915
- MediaTek Mt7916
- MediaTek Mt7981
- MediaTek Mt7986
- MediaTek Software Development Kit
- OpenWrt

## Related threats

- [MediaTek ccci out of bounds write](https://junglewise.ai/threats/cve-2026-20552-in-ccci-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek vdec out-of-bounds write in type confusion](https://junglewise.ai/threats/cve-2026-20579-in-vdec-there-is-a-possible-out-of-bounds-write-due-to-type)
- [MediaTek out of bounds write in modem](https://junglewise.ai/threats/cve-2026-20544-in-meta-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek Modem information disclosure due to logic error](https://junglewise.ai/threats/cve-2026-20543-in-modem-there-is-a-possible-information-disclosure-due-to-a)
- [MediaTek Modem out-of-bounds read due to missing permission check](https://junglewise.ai/threats/cve-2026-20538-in-modem-there-is-a-possible-out-of-bounds-read-due-to-a-missing)