Total
33 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-20450 | 1 Mediatek | 102 Mt2735, Mt2735 Firmware, Mt2737 and 99 more | 2026-10-26 | N/A | 6.5 MEDIUM |
| In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01753620; Issue ID: MSV-6100. | |||||
| CVE-2026-20476 | 1 Mediatek | 6 Mt6813, Mt6813 Firmware, Mt6986 and 3 more | 2026-10-23 | N/A | 5.5 MEDIUM |
| In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981532; Issue ID: MSV-7660. | |||||
| CVE-2026-20490 | 1 Mediatek | 10 Mt6813, Mt6813 Firmware, Mt6982vb and 7 more | 2026-10-23 | N/A | 4.4 MEDIUM |
| In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10981501; Issue ID: MSV-7669. | |||||
| CVE-2025-20747 | 6 Google, Linuxfoundation, Mediatek and 3 more | 23 Android, Yocto, Mt2718 and 20 more | 2026-10-18 | N/A | 6.7 MEDIUM |
| In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966. | |||||
| CVE-2025-20746 | 6 Google, Linuxfoundation, Mediatek and 3 more | 23 Android, Yocto, Mt2718 and 20 more | 2026-10-18 | N/A | 6.7 MEDIUM |
| In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967. | |||||
| CVE-2026-20541 | 1 Mediatek | 166 Mt2716, Mt2716 Firmware, Mt2735 and 163 more | 2026-10-09 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8911. | |||||
| CVE-2026-20540 | 1 Mediatek | 166 Mt2716, Mt2716 Firmware, Mt2735 and 163 more | 2026-10-09 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8912. | |||||
| CVE-2026-20539 | 1 Mediatek | 166 Mt2716, Mt2716 Firmware, Mt2735 and 163 more | 2026-10-09 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8913. | |||||
| CVE-2026-20538 | 1 Mediatek | 166 Mt2716, Mt2716 Firmware, Mt2735 and 163 more | 2026-10-09 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8914. | |||||
| CVE-2026-20528 | 1 Mediatek | 20 Mt2735, Mt2735 Firmware, Mt2737 and 17 more | 2026-10-09 | N/A | 6.7 MEDIUM |
| In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS11428950 (Note: For MT6880, MT6890) / ALPS10563453 (Note: For MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988) / AUTO00858766 (Note: For MT2735, MT2737); Issue ID: MSV-9893. | |||||
| CVE-2026-20534 | 1 Mediatek | 166 Mt2716, Mt2716 Firmware, Mt2735 and 163 more | 2026-10-09 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01797547; Issue ID: MSV-9155. | |||||
| CVE-2026-20525 | 1 Mediatek | 44 Mt2716, Mt2716 Firmware, Mt6835 and 41 more | 2026-10-08 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870473 / MOLY00814393; Issue ID: MSV-9041. | |||||
| CVE-2026-20526 | 1 Mediatek | 110 Mt2716, Mt2716 Firmware, Mt2735 and 107 more | 2026-10-08 | N/A | 7.5 HIGH |
| In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01898195; Issue ID: MSV-8906. | |||||
| CVE-2026-20527 | 1 Mediatek | 110 Mt2716, Mt2716 Firmware, Mt2735 and 107 more | 2026-10-08 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01864925 / MOLY01210562; Issue ID: MSV-8303. | |||||
| CVE-2026-20519 | 1 Mediatek | 114 Mt2716, Mt2716 Firmware, Mt2735 and 111 more | 2026-10-08 | N/A | 7.5 HIGH |
| In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778993; Issue ID: MSV-8898. | |||||
| CVE-2026-20520 | 1 Mediatek | 114 Mt2716, Mt2716 Firmware, Mt2735 and 111 more | 2026-10-08 | N/A | 7.5 HIGH |
| In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778988; Issue ID: MSV-8897. | |||||
| CVE-2026-20543 | 1 Mediatek | 166 Mt2716, Mt2716 Firmware, Mt2735 and 163 more | 2026-10-08 | N/A | 5.5 MEDIUM |
| In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761. | |||||
| CVE-2025-20760 | 1 Mediatek | 51 Mt2735, Mt2737, Mt6833 and 48 more | 2026-10-07 | N/A | 6.5 MEDIUM |
| In Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01676750; Issue ID: MSV-4653. | |||||
| CVE-2025-20794 | 1 Mediatek | 54 Mt2735, Mt2737, Mt6813 and 51 more | 2026-10-07 | N/A | 6.5 MEDIUM |
| In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689259 / MOLY01586470; Issue ID: MSV-4847. | |||||
| CVE-2026-20503 | 1 Mediatek | 114 Mt2716, Mt2716 Firmware, Mt2735 and 111 more | 2026-09-09 | N/A | 5.3 MEDIUM |
| In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01371002; Issue ID: MSV-9020. | |||||