CVE-2026-20466

In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: AUTO00845351 (Note: For MT2737) / ALPS11072643 (Note: For MT6880, MT6890, MT6990); Issue ID: MSV-6929.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.2

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.mediatek.com/product-security-bulletin/August-2026

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En el arranque seguro, existe una posible escalada de privilegios debido a un desbordamiento de búfer de montón. Esto podría llevar a una escalada local de privilegios, si un atacante tiene acceso físico al dispositivo, sin necesidad de privilegios de ejecución adicionales. No se necesita interacción del usuario para la explotación. ID del parche: AUTO00845351 (Nota: Para MT2737) / ALPS11072643 (Nota: Para MT6880, MT6890, MT6990); ID del problema: MSV-6929.

Information

Published : 2026-08-03 03:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-20466

Mitre link : CVE-2026-20466

CVE.ORG link : CVE-2026-20466

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-20466", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20466", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T19:37:59.018493Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "affected": [{"source": "security@mediatek.com", "affectedData": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "versions": [{"status": "affected", "version": "MT2737"}, {"status": "affected", "version": "MT6880"}, {"status": "affected", "version": "MT6890"}, {"status": "affected", "version": "MT6990"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-03T03:16:41.433", "references": [{"url": "https://www.mediatek.com/product-security-bulletin/August-2026", "source": "security@mediatek.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@mediatek.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In sec boot, there is a possible escalation of privilege due to a heap buffer overflow. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: AUTO00845351 (Note: For MT2737) / ALPS11072643 (Note: For MT6880, MT6890, MT6990); Issue ID: MSV-6929."}, {"lang": "es", "value": "En el arranque seguro, existe una posible escalada de privilegios debido a un desbordamiento de b\u00fafer de mont\u00f3n. Esto podr\u00eda llevar a una escalada local de privilegios, si un atacante tiene acceso f\u00edsico al dispositivo, sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n. ID del parche: AUTO00845351 (Nota: Para MT2737) / ALPS11072643 (Nota: Para MT6880, MT6890, MT6990); ID del problema: MSV-6929."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security@mediatek.com"}