EUVD-2026-115017
GHSA-mjqg-35qw-pc3j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ccci interface remotely
-
DeliveryDeliver crafted data to parser
-
ExploitUser interaction triggers processing
-
ExecutionOut-of-bounds write corrupts memory
-
ImpactComponent crash / denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the ccci (cross-core communication interface / modem subsystem) on the listed MediaTek chipsets and requires user interaction (UI:R) to trigger processing of the malicious input; no authentication is required (PR:N). The specific feature state or input that triggers the missing bounds check is not described in the available sources. Limiting factors: the attack succeeds only against the enumerated affected chipset models, requires a user action to proceed, and yields denial of service only (C:N/I:N/A:H) with no additional execution privileges - it does not, per the vendor, grant code execution. |
| Impact | This is a medium-severity (CVSS 6.5) availability-only issue whose real-world priority is moderate, not urgent. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) and causes only availability impact (C:N/I:N/A:H) - i.e. denial of service, not code execution. This is consistent across signals: SSVC reports Exploitation 'none', Automatable 'no', and Technical Impact only 'partial', and the vuln.today decision label is 'this_month' rather than act_now or emergency. There is no CISA KEV listing and no EPSS score was supplied, so widespread or active exploitation is not indicated. Note a tension worth flagging: the CWE is CWE-787 (out-of-bounds write), a class often associated with memory-corruption code execution, yet the vendor explicitly scopes impact to 'remote denial of service with no additional execution privileges needed' and the CVSS sets C:N/I:N - treat this as a DoS, not a confirmed RCE, unless MediaTek states otherwise. Overall: a legitimate patch-this-cycle item for affected MediaTek-based devices, but not a drop-everything emergency. |
| Exploit ScenarioDerived | An attacker delivers specially crafted data to the ccci (cross-core/modem communication interface) of a vulnerable MediaTek chipset, and a user action triggers processing of that data, causing an out-of-bounds write that crashes the affected component and denies service. No authentication is required (PR:N) but user interaction is (UI:R), and the outcome is a crash rather than code execution. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 02, 2026
Denial of service in the MediaTek ccci subsystem affects the enumerated chipsets (MT6880, MT6890, MT6813, MT6986, MT6982, MT6980D, MT2735 and MT2737, with MT6990 and MT6988 also listed by EUVD) when a user is induced to process crafted input; a missing bounds check allows an out-of-bounds write, but the assessed impact is availability only, with no confidentiality or integrity loss and no code execution per the vendor. The issue is medium severity (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), requires user interaction, and is not reported as actively exploited; no public exploit identified at time of analysis, and SSVC records exploitation as none and automatable as no.
RemediationAI
Patch available per vendor advisory: apply the MediaTek November 2026 Product Security Bulletin updates for the applicable chipset, using ALPS11523478 for MT6880/MT6890, ALPS11297423 for MT6813/MT6986/MT6982/MT6980D, and AUTO00864897 for MT2735/MT2737. Identify the exact chipset before selecting the patch, and confirm coverage for MT6990 and MT6988 in the bulletin because EUVD lists them but the provided data maps no patch ID to them. No vendor-documented workaround is provided in the available sources; because exploitation requires user interaction (UI:R), limiting exposure to untrusted content that reaches the ccci path is only a stopgap and does not replace the vendor patch. Advisory: https://www.mediatek.com/product-security-bulletin/November-2026.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ccci is MediaTek's cross-core communication interface associated with the modem subsystem; CVE-2026-20552 is a CWE-787 out-of-bounds write caused by a missing bounds check in that component. The CPE identifies the affected platform generically as mediatek_chipset, and EUVD enumerates MT6980D, MT6982, MT6986, MT2735, MT6880, MT2737, MT6990, MT6813, MT6890 and MT6988. The assessed vector is network-reachable (AV:N), unauthenticated (PR:N), and requires user interaction (UI:R); only availability is impacted (A:H) with C:N/I:N, and the trigger input or feature state is not described in the available sources. Vendor patch IDs are split by chipset family: ALPS11523478 for MT6880/MT6890, ALPS11297423 for MT6813/MT6986/MT6982/MT6980D, and AUTO00864897 for MT2735/MT2737. SSVC technical impact is partial and automatable is no.
Know when Mediatek Chipset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-reachable unauthenticated trigger needing user interaction (UI:R); vendor scopes impact to denial of service only, so C:N/I:N/A:H.
Primary rating from Vendor (MediaTek).
CVSS VectorVendor: MediaTek
Lifecycle Timeline
3DescriptionCVE.org
In ccci, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11523478 (Note: For MT6880, MT6890) / ALPS11297423 (Note: For MT6813, MT6986, MT6982, MT6980D) / AUTO00864897 (Note: For MT2735, MT2737); Issue ID: MSV-10724.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged atta
Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset varian
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalatio
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local proc
Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges wi
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privi
Exploit-DB