Threat database

CVE-2026-20466 is a medium severity vulnerability in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990. It involves a heap buffer overflow in the secure boot process that could allow local escalation of privilege without user interaction. Exploitation requires physical access to the device but no additional execution privileges. The vulnerability is identified as CWE-787 (Out-of-bounds Write).

In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00489200; Issue ID: MSV-7834.

In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297.

In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01716533; Issue ID: MSV-6309.

In Telephony, there is a possible memory corruption due to a heap buffer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11006447; Issue ID: MSV-7871.

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01267281 / MOLY01318201; Issue ID: MSV-6486.

In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788.

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842.

In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01402160; Issue ID: MSV-7298.

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01826924; Issue ID: MSV-7301.

In wlan STA driver, there is a possible system crash due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00480851; Issue ID: MSV-6338.

CVE-2026-20455 is a high-severity vulnerability in MediaTek chipsets caused by an out-of-bounds write due to a missing bounds check in the geniezone component. Exploitation does not require user interaction but requires the attacker to already have System privilege. Successful exploitation could lead to local escalation of privilege with high impact on confidentiality, integrity, and availability. The vulnerability affects a wide range of MediaTek chipset models. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.

CVE-2026-20454 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in MediaTek chipsets affecting multiple versions. It involves a possible out-of-bounds write in the geniezone component, which could allow a local attacker with existing System privileges to escalate their privileges further. Exploitation does not require user interaction. The vulnerability has a CVSS score of 6.4, indicating medium severity. No official patch or remediation guidance is currently confirmed from the vendor. There are no known exploits in the wild at this time.

CVE-2026-20453 is an out-of-bounds write vulnerability in the MediaTek chipset's geniezone component caused by a missing bounds check. This flaw could allow a local attacker who already has System privileges to escalate their privileges further without requiring user interaction. The vulnerability affects multiple MediaTek chipset versions. The CVSS score is 6.7, indicating a medium severity level. No official patch or remediation guidance has been confirmed yet.

CVE-2026-20452 is a heap buffer overflow vulnerability in the wlan AP driver of MediaTek chipsets. This memory corruption flaw can be exploited remotely by an adjacent attacker without user interaction, requiring only user-level execution privileges. Successful exploitation could lead to remote code execution with high impact on confidentiality, integrity, and availability. The vulnerability affects multiple MediaTek chipset models including MT6890, MT7615, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, and MT7993. The CVSS v3.1 base score is 8.0, indicating a high severity. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.

CVE-2026-20451 is a type confusion vulnerability in the slbc component of MediaTek chipsets that may cause an out-of-bounds write. Exploitation requires the attacker to already have System privileges and does not require user interaction. The vulnerability could lead to local escalation of privilege with high impact on confidentiality, integrity, and availability. It affects multiple MediaTek chipset models. No official patch or remediation guidance has been confirmed yet.

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01753620; Issue ID: MSV-6100.

In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01760138; Issue ID: MSV-6148.

CVE-2026-20448 is a vulnerability in MediaTek chipsets involving improper handling of insufficient permissions in the geniezone component. It allows local escalation of privilege due to a missing permission check, but only if the attacker already has System privilege. Exploitation does not require user interaction. The vulnerability affects multiple MediaTek chipset versions. The CVSS score is 6.7, indicating medium severity. No official patch or remediation level has been confirmed yet.

CVE-2026-20447 is an out-of-bounds read vulnerability (CWE-125) in MediaTek chipsets affecting multiple models. It exists in the geniezone component due to a missing bounds check, potentially allowing a local escalation of privilege if the attacker already has System privileges. No user interaction is required for exploitation. The vulnerability has a CVSS score of 6.7, indicating medium severity. There is no confirmed patch or official remediation available at this time, and no known exploits in the wild have been reported.