CVE-2026-20471

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10991588 (Note: For MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (Note: For MT2735, MT2737); Issue ID: MSV-7790.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.mediatek.com/product-security-bulletin/August-2026

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En DA, hay una posible escritura fuera de límites debido a una comprobación de límites faltante. Esto podría llevar a una denegación de servicio local, si un atacante tiene acceso físico al dispositivo, sin necesidad de privilegios de ejecución adicionales. La interacción del usuario no es necesaria para la explotación. ID del parche: ALPS10991588 (Nota: Para MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (Nota: Para MT2735, MT2737); ID del problema: MSV-7790.

Information

Published : 2026-08-03 03:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-20471

Mitre link : CVE-2026-20471

CVE.ORG link : CVE-2026-20471

JSON object : View

Products Affected

No product.

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-20471", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20471", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T19:04:13.222828Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "affected": [{"source": "security@mediatek.com", "affectedData": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "versions": [{"status": "affected", "version": "MT2735"}, {"status": "affected", "version": "MT2737"}, {"status": "affected", "version": "MT6813"}, {"status": "affected", "version": "MT6880"}, {"status": "affected", "version": "MT6890"}, {"status": "affected", "version": "MT6986"}, {"status": "affected", "version": "MT6988"}, {"status": "affected", "version": "MT6990"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-03T03:16:42.060", "references": [{"url": "https://www.mediatek.com/product-security-bulletin/August-2026", "source": "security@mediatek.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@mediatek.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10991588 (Note: For MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (Note: For MT2735, MT2737); Issue ID: MSV-7790."}, {"lang": "es", "value": "En DA, hay una posible escritura fuera de l\u00edmites debido a una comprobaci\u00f3n de l\u00edmites faltante. Esto podr\u00eda llevar a una denegaci\u00f3n de servicio local, si un atacante tiene acceso f\u00edsico al dispositivo, sin necesidad de privilegios de ejecuci\u00f3n adicionales. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n. ID del parche: ALPS10991588 (Nota: Para MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (Nota: Para MT2735, MT2737); ID del problema: MSV-7790."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security@mediatek.com"}