> MSV-4626: Mediatek Baseband Null Dereference in inet_msg_unpack_generic_header

An attacker sending a malformed SIP message over VoLTE to a device with a Mediatek baseband can trigger the vulnerability described here. The impact is DoS in the baseband, triggered by malformed VoLTE message such as SIP INVITE or MESSAGE request. The vulnerability described in this advisory affected a wide range of Mediatek devices. This vulnerability is assigned CVE-2025-20725. Vulnerability Details Crash happens due to a NULL access. int inet_msg_unpack_generic_header (uint param_1,uint param_2,char *param_3) { bVar1 = inet_msg_is_header_val_int(param_1,param_2); if (bVar1 == 0) { iVar3 = 0; if (param_2 < 0x98) { pcVar2 = (code *)inet_msg_header_unpack_fn(param_1,param_2); // [1]: HERE pcVar2 is NULL, thus the following dereference causes a crash!