EUVD-2026-19569Severity by source
AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
In sec boot, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service, if an attacker has physical access to the device, with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09963054; Issue ID: MSV-3899.
AnalysisAI
Integer overflow in MediaTek secure boot (sec boot) leads to out-of-bounds write causing local denial of service on affected MediaTek chipsets. Attack requires physical device access and local user execution privileges, with no user interaction needed. EPSS score of 0.02% and CISA SSVC assessment of 'none' exploitation status indicate low real-world risk despite the moderate CVSS base score of 4.3.
Technical ContextAI
The vulnerability exists in the secure boot component of MediaTek chipsets, specifically in integer handling that fails to validate bounds before memory operations. This is classified as CWE-787 (out-of-bounds write), which occurs when an integer overflow calculation produces a value that bypasses buffer bounds checks, allowing writes beyond allocated memory regions. The affected products are MediaTek chipsets including the MT6813, which are widely integrated into mobile and IoT devices. The physical attack vector requirement significantly constrains exploitation scenarios, as it mandates direct hardware access to the target device.
RemediationAI
MediaTek has released a patch identified as ALPS09963054 (Issue ID: MSV-3899) to address the integer overflow in secure boot. Devices should be updated to firmware versions incorporating this patch via manufacturer-issued over-the-air (OTA) updates or through direct device firmware updates available from the product vendor. No workarounds are available for this hardware-level vulnerability; patching or firmware update is the only mitigation. Reference MediaTek's Product Security Bulletin (https://corp.mediatek.com/product-security-bulletin/April-2026) and the National Vulnerability Database entry (https://nvd.nist.gov/vuln/detail/CVE-2026-20446) for specific device model guidance and update availability.
More in Mediatek Chipset
View allOut-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-cont
Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment con
Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user
Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gain
Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a
Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Andr
Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System
Local privilege escalation in MediaTek's geniezone hypervisor component affects 36 distinct chipsets spanning budget to
Out-of-bounds write in MediaTek's slbc (secure local buffer component) due to type confusion allows local privilege esca
Local privilege escalation in MediaTek geniezone component due to missing bounds check allows System-privileged actors t
Local privilege escalation in MediaTek chipsets (MT6765, MT8893, MT8791T, and 19 others) due to missing permission check
Remote denial of service in MediaTek modem firmware across 47+ chipset variants allows attackers to crash the modem via
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today