CVE-2026-68590 is an out-of-bounds read vulnerability in MediaTek chipsets' ip_stack component caused by improper input validation. It can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation may lead to a denial of service condition. Multiple MediaTek chipset models are affected.
CVE-2026-68589 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. Exploitation does not require user interaction but requires the attacker to already have System privilege. This flaw could allow local escalation of privilege. A patch identified as MOLY01320076 addresses the issue.
CVE-2026-68588 is an integer overflow vulnerability in MediaTek chipsets' modem component. The flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on a user equipment (UE) device without requiring user interaction or additional privileges. Multiple MediaTek chipset models are affected. A patch has been identified by MediaTek under Patch IDs MOLY01334054 and MOLY01312486.
CVE-2026-20600 is a vulnerability in MediaTek chipsets that causes a reachable assertion failure in the modem component due to a logic error. This flaw can lead to a remote denial of service if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional privileges. A patch has been identified (MOLY01416152) but no explicit patch availability status is provided in the input.
CVE-2026-20599 is a vulnerability in MediaTek chipsets where a missing permission check in the modem component allows for local escalation of privilege. Exploitation does not require user interaction but requires the attacker to already have System privilege. Multiple MediaTek chipset models are affected.
CVE-2026-20598 is an out-of-bounds read vulnerability in MediaTek chipsets caused by an integer overflow in the modem component. Exploitation requires no user interaction and can lead to remote denial of service if a user equipment (UE) connects to a rogue base station controlled by an attacker. Multiple MediaTek chipset models are affected.
CVE-2026-20597 is an out-of-bounds read vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. Exploitation can lead to a remote denial of service when a user equipment (UE) connects to a rogue base station controlled by an attacker. No user interaction or additional execution privileges are required for exploitation. A patch identified as MOLY01758223 addresses this issue.
CVE-2026-20596 is an out-of-bounds read vulnerability in MediaTek chipsets' modem component caused by improper input validation. Exploitation could lead to a remote denial of service without requiring user interaction or additional execution privileges. The attack scenario involves a user equipment (UE) connecting to a rogue base station controlled by an attacker.
CVE-2026-20595 is a vulnerability in MediaTek chipsets involving an out-of-bounds write in neuropilot due to missing bounds checking. This flaw could allow a local attacker who already has System privileges to escalate their privileges further. Exploitation does not require user interaction. A patch is identified by MediaTek as ALPS11263078.
CVE-2026-20594 is an out-of-bounds read vulnerability in MediaTek chipsets caused by a missing bounds check in the modem component. Exploitation can lead to a remote denial of service when a user equipment (UE) connects to a rogue base station controlled by an attacker. No additional execution privileges or user interaction are required for exploitation. Multiple MediaTek chipset models are affected. Patches have been issued under Patch IDs MOLY01349680 and MOLY01369097.
CVE-2026-20593 is a vulnerability in MediaTek chipsets that causes a reachable assertion failure in the modem component due to improper input validation. This flaw can lead to an application crash resulting in a remote denial of service (DoS) if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges.
CVE-2026-20592 is an information disclosure vulnerability in MediaTek chipsets caused by insertion of sensitive information into log files. It affects multiple MediaTek chipset models and could allow local attackers with system privileges to access sensitive data without user interaction.
CVE-2026-20591 is a use-after-free vulnerability in the GPU pdma component of MediaTek chipsets MT6993 and MT8910. It allows local escalation of privilege without requiring additional execution privileges or user interaction. A patch has been identified but no public exploit or detailed CVSS score is available.
CVE-2026-20590 is a stack-based buffer overflow vulnerability in MediaTek chipsets that can cause a system crash due to a logic error in the display component. Exploitation requires the attacker to have System privilege but does not require user interaction. This vulnerability can lead to a local denial of service condition.
CVE-2026-20585 is an out-of-bounds write vulnerability in MediaTek chipsets' modem component caused by a missing bounds check. This flaw could allow remote escalation of privilege if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation does not require user interaction or additional execution privileges.
CVE-2026-20584 is a vulnerability in MediaTek chipsets caused by a missing bounds check in the USB component, leading to a possible out-of-bounds write and memory corruption. Exploitation does not require user interaction but requires the attacker to already have System privileges. This flaw could enable local escalation of privilege. A patch identified as ALPS11411916 addresses this issue.
CVE-2026-20583 is a use-after-free vulnerability in the USB component of MediaTek chipsets. It can cause a system crash leading to a local denial of service if exploited by an actor with System privilege. Exploitation does not require user interaction. Multiple MediaTek chipset models are affected.
CVE-2026-20582 is a double free vulnerability in the USB component of MediaTek chipsets. This memory corruption flaw could allow local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. The affected chipsets include MT6993, MT8188, MT8189, MT8532, and MT8668.
CVE-2026-20581 is a use-after-free vulnerability in the USB component of MediaTek chipsets. It can cause memory corruption leading to local privilege escalation if the attacker already has system privileges. Exploitation does not require user interaction. A patch has been identified (Patch ID: ALPS11411985).
CVE-2026-20580 is a use-after-free vulnerability in the USB component of MediaTek chipsets. It can cause a system crash leading to a local denial of service. Exploitation requires the attacker to already have System privilege, and no user interaction is needed. Multiple MediaTek chipset models are affected.