MediaTek gnss Out-of-Bounds Write Flaws

Out-of-bounds write in the GNSS (satellite positioning) component of MediaTek chipsets allows a local attacker with no additional execution privileges to crash or deny service on affected devices, with availability-only impact (CVSS 6.2, CWE-787). The issue affects chipsets MT6990, MT6890, MT6988, MT6880, MT6986, MT6982, MT6980D, MT2735 and MT2737 and is addressed by MediaTek Patch ID ALPS11309816 per the November 2026 Product Security Bulletin. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation as none; the description states user interaction is needed, which limits unattended or remote abuse.

Local denial of service in the GNSS (location) component of MediaTek chipsets MT6990, MT6980D, MT2737, MT6982, MT6988, MT6986 and MT6813 stems from a missing bounds check that permits an out-of-bounds write, carrying an assessed CVSS of 5.5 with availability-only impact. Exploitation requires local access to the device plus user interaction (AV:L/UI:R) and yields no additional execution privileges, no code execution and no data exposure; no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as none. MediaTek has released patch ALPS11309305 under issue ID MSV-10730 in its November 2026 product security bulletin.