EUVD-2026-52055
GHSA-q4fj-5hvx-3jc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain Wi-Fi radio adjacency to target device
-
DeliveryIdentify device operating in AP mode on affected MediaTek chipset
-
ExploitCraft malformed wireless frames targeting AP driver heap buffer
-
ExecutionTransmit frames to trigger missing bounds check
-
PersistOut-of-bounds heap write corrupts driver memory
-
ImpactAchieve privileged code execution on target device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be within Wi-Fi radio range of a device operating in Access Point (AP) mode using one of the affected MediaTek chipsets (MT7986, MT7916, MT7915, MT7981, MT6890). The WLAN AP driver must be active - devices not operating in AP mode are not directly affected in this role. Per CVSS PR:N, no authentication or credentials are required. Per CVSS UI:N, no victim interaction is needed. Exploitation is hard-limited by physical or radio adjacency: attackers cannot reach the driver from the public internet without first establishing Wi-Fi proximity. SSVC rates automatable as 'no,' suggesting exploitation requires some degree of crafting specificity rather than trivial spray-and-pray delivery. There is no indication that any non-default configuration is required - all devices with these chipsets running in AP mode appear to be in scope by default. |
| Impact | The CVSS 3.1 score of 8.1 (High) is driven by AV:A/AC:L/PR:N/UI:N, reflecting low-complexity, zero-authentication exploitation constrained only by Wi-Fi radio adjacency. The C:H/I:H pair signals full compromise of confidentiality and integrity on the vulnerable system if exploited successfully. Against this, EPSS at 0.17% (6th percentile) and SSVC exploitation status of 'none' indicate no observed real-world exploitation at time of analysis. SSVC additionally rates automatable as 'no,' consistent with the adjacent-only vector - mass internet-scale exploitation is not feasible, limiting realistic risk to targeted attacks by physically proximate or network-adjacent adversaries. The juxtaposition of total technical impact (SSVC) with zero current exploitation and low EPSS is coherent: the vulnerability is serious if exploited but not yet weaponized. Priority should be higher for operators of public-facing wireless infrastructure (hotspots, enterprise APs) than for home users behind NAT. |
| Exploit ScenarioDerived | An attacker within Wi-Fi radio range of a device running an affected MediaTek WLAN AP driver (e.g., a public hotspot or enterprise access point) transmits specially crafted wireless management or data frames that trigger the missing bounds check in the AP driver's heap buffer. The out-of-bounds write corrupts adjacent heap memory, enabling the attacker to redirect driver execution and achieve elevated privileges on the device - requiring no prior authentication, credentials, or victim interaction. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code.
RemediationAI
The primary fix is applying the upstream patch identified as WCNCR00489200 (Issue ID: MSV-7834), referenced in MediaTek's August 2026 Product Security Bulletin at https://www.mediatek.com/product-security-bulletin/August-2026. OEM device manufacturers integrating affected MediaTek chipsets must incorporate this patch into updated firmware releases and publish them to end users. End users should check for and apply any available router or access point firmware updates from their device vendor. No exact patched firmware version number is independently confirmed in available data - only the MediaTek patch ID is provided, and OEM release timelines vary. Where firmware updates are unavailable, compensating controls include enabling WPA3 or WPA2-Enterprise to limit which clients can associate with the AP (reducing, but not eliminating, attack surface since the vulnerability may be triggerable pre-authentication), and deploying wireless intrusion detection to flag anomalous frame patterns. MAC filtering is not a reliable mitigation as it can be spoofed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability (CWE-122, Heap-based Buffer Overflow) resides in the WLAN Access Point driver shipped with multiple MediaTek SoCs: MT7986, MT7916, MT7915, MT7981, and MT6890. These are embedded Wi-Fi chipsets used pervasively in home routers, SMB access points, and IoT networking hardware from OEMs such as ASUS, TP-Link, and Xiaomi. The AP driver processes incoming wireless frames from client devices; a missing bounds check on a heap-allocated buffer allows attacker-controlled data to overwrite adjacent memory regions. The CPE string cpe:2.3:a:mediatek,_inc.:mediatek_chipset:*:*:*:*:*:*:*:* covers all versions of these chipsets. The root cause class (CWE-122) distinguishes this as a heap - not stack - overflow, meaning exploitation typically targets heap metadata or adjacent heap objects to redirect execution flow or corrupt driver state for privilege escalation.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Adjacent vector confirmed by wireless AP context; no privileges or interaction required; C:H/I:H from privilege escalation; A:N as description targets EoP, not crash.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
2DescriptionCVE.org
In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00489200; Issue ID: MSV-7834.
Executive ViewAI
CVE-2026-20465 affects MediaTek WLAN AP drivers across multiple chipsets, allowing adjacent-network attackers to gain unauthorized access and escalate privileges on access points, routers, and network-connected devices without authentication. This creates a risk of device takeover, data interception, and lateral movement within your network. No vendor patch is currently available, leaving this vulnerability unmitigated on deployed infrastructure.
Restrict adjacent-network access to affected devices through network segmentation and VLAN isolation; enforce multi-factor authentication and IP allowlisting for device management interfaces; enable detailed audit logging and real-time alerting for any configuration changes or privilege escalation attempts; monitor affected devices for crashes or anomalous behavior that may indicate exploitation; regularly review and restrict network connectivity permissions to only essential management traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of
Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants,
Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to
Exploit-DB