Mediatek Inc Mediatek Chipset vulnerabilities

CVE-2026-20421 [MEDIUM] CWE-125 CVE-2026-20421: In Modem, there is a possible system crash due to improper input validation. This could lead to remo In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01738293; Issue ID: MSV-5922.

CVE-2026-20402 [MEDIUM] CWE-787 CVE-2026-20402: In Modem, there is a possible system crash due to improper input validation. This could lead to remo In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00693083; Issue ID: MSV-5928.

CVE-2026-20468 [MEDIUM] CWE-787 CVE-2026-20468: In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to In apusys, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00833804; Issue ID: MSV-6741.

CVE-2026-20474 [MEDIUM] CWE-367 CVE-2026-20474: In display, there is a possible escalation of privilege due to a race condition. This could lead to In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.

CVE-2026-20405 [MEDIUM] CWE-617 CVE-2026-20405: In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01688495; Issue ID: MSV-4818.

CVE-2026-20454 [MEDIUM] CWE-367 CVE-2026-20454: In geniezone, there is a possible out of bounds write due to a race condition. This could lead to lo In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786.

CVE-2026-20438 [MEDIUM] CWE-367 CVE-2026-20438: In MAE, there is a possible out of bounds write due to a race condition. This could lead to local es In MAE, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10431920; Issue ID: MSV-5835.

CVE-2026-20461 [MEDIUM] CWE-787 CVE-2026-20461: In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01267281 / MOLY01318201; Issue ID: MSV-64

CVE-2026-20470 [MEDIUM] CWE-926 CVE-2026-20470: In Telephony, there is a possible information disclosure due to a missing permission check. This cou In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189.

CVE-2026-20460 [MEDIUM] CWE-288 CVE-2026-20460: In Modem, there is a possible information disclosure due to improper input validation. This could le In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01811421; Issue ID: MSV-6788.

CVE-2026-20515 [MEDIUM] CWE-416 CVE-2026-20515: In gpu, there is a possible system crash due to use after free. This could lead to local information In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11122991; Issue ID: MSV-8132.

CVE-2026-20494 [MEDIUM] CWE-125 CVE-2026-20494: In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to lo In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10960006 / BORA00155314, BORA00155001, BORA00154907; Issue ID: MSV-7570.

CVE-2026-20478 [MEDIUM] CWE-787 CVE-2026-20478: In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.

CVE-2026-20480 [MEDIUM] CWE-122 CVE-2026-20480: In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960023 (Note: For MT6880, MT6890, MT6980D, MT6988, MT6990) / AUTO00851189 (Note: For MT2735, MT3737); Issue ID: MSV-758

CVE-2026-20543 [MEDIUM] CWE-215 CVE-2026-20543: In Modem, there is a possible information disclosure due to a logic error. This could lead to local In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761.

CVE-2026-20503 [MEDIUM] CWE-617 CVE-2026-20503: In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01371002; Issue ID: MSV-9020.

CVE-2026-20504 [MEDIUM] CWE-617 CVE-2026-20504: In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00755024; Issue ID: MSV-7865.

CVE-2026-20457 [MEDIUM] CWE-476 CVE-2026-20457: In Modem, there is a possible system crash due to improper input validation. This could lead to remo In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01826924; Issue ID: MSV-7301.

CVE-2026-20459 [MEDIUM] CWE-288 CVE-2026-20459: In Modem, there is a possible system crash due to improper input validation. This could lead to remo In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01816800; Issue ID: MSV-6842.

CVE-2026-20527 [MEDIUM] CWE-129 CVE-2026-20527: In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01864925 / MOLY01210562; Issue ID: MSV-8303.