Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (MediaTek) · only source for this CVE.
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00480138; Issue ID: MSV-6295.
AnalysisAI
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user execution to corrupt memory and achieve remote code execution without user interaction. The flaw affects multiple MediaTek Wi-Fi chipsets commonly embedded in routers and access points (MT7615, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, MT7993, MT6890). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerability resides in the wireless LAN access point (AP) driver shipped with MediaTek chipsets, which implements 802.11 frame processing on the AP side. CWE-122 (Heap-Based Buffer Overflow) indicates the driver fails to validate the size of attacker-influenced data before copying it into a heap allocation, corrupting adjacent heap metadata or function pointers. Because the driver runs in privileged firmware/kernel context on the chipset, memory corruption is leveraged for arbitrary code execution. The CPE entry (cpe:2.3:a:mediatek,_inc.:mediatek_chipset) is generic, but the EUVD enumerates the specific chipset models - MT7615/7915/7916/7981/7986/7990/7992/7993 and MT6890 - which are widely deployed in consumer and enterprise Wi-Fi 5/6/7 routers, mesh systems, and OEM AP platforms.
RemediationAI
Apply the patch referenced by MediaTek as Patch ID WCNCR00480138 (Issue ID MSV-6295) per the June 2026 MediaTek Product Security Bulletin (https://corp.mediatek.com/product-security-bulletin/June-2026); because MediaTek delivers fixes through downstream OEMs, contact your AP/router vendor (e.g., ASUS, Netgear, TP-Link, Ubiquiti, Zyxel, and OpenWrt-based device vendors using these chipsets) for the corresponding firmware update - patch available per vendor advisory, but no single fix version is published upstream. If patched firmware is not yet available, compensating controls include restricting Wi-Fi access via WPA3 or strong WPA2-Enterprise authentication to limit who can become an adjacent attacker, disabling guest/open SSIDs on affected APs, isolating affected AP management interfaces on a dedicated VLAN, and reducing radio range or relocating APs away from public space - trade-offs include reduced coverage and inconvenience for legitimate guest users, and none of these controls fully eliminate the risk from an authorized but malicious station.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-33541
GHSA-mfvp-3qw7-v5gw