17
CVEs
0
Critical
2
High
0
KEV
0
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
15
LOW
0
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-20501 | Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-20502 | Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-20509 | Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20510 | Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants, allowing an attacker who has already gained System-level privilege to escalate further to higher privilege tiers without any user interaction. The flaw is confirmed by MediaTek in their September 2026 Product Security Bulletin under Patch ID ALPS11134622 and Issue ID MSV-8894. No public exploit code or active exploitation is confirmed; SSVC designates this as non-automatable with no current exploitation activity. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20506 | Privilege escalation via use-after-free in MediaTek's Android Audio Hardware Abstraction Layer (Audio HAL) affects over 65 distinct chipset families spanning mobile, tablet, and IoT SoCs. An attacker who has already obtained System-level privilege on a device running an affected MediaTek chipset can trigger the UAF condition to escalate further - gaining full control over confidentiality, integrity, and availability without any user interaction. No public exploit or active exploitation has been identified at time of analysis; the patch is available through MediaTek's September 2026 product security bulletin. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20507 | Local privilege escalation in the MediaTek Audio Hardware Abstraction Layer (HAL) allows an attacker who has already obtained System-level privilege to further escalate to higher privileges via a use-after-free condition (CWE-416). The vulnerability affects over 65 MediaTek chipset models spanning Android smartphones, tablets, IoT, and connected-device SoCs. No public exploit code or CISA KEV listing exists at time of analysis; however, the broad chipset surface across Android device families makes this relevant for any organization managing large Android fleets. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20508 | Privilege escalation in MediaTek's Power Hardware Abstraction Layer (Power HAL) allows an attacker who has already obtained System-level privilege on an Android device to further escalate to higher privilege through a type confusion vulnerability (CWE-843). The flaw spans a broad range of MediaTek chipsets - over 40 SoC variants - meaning it affects a wide swath of Android smartphones, tablets, and embedded devices. No public exploit has been identified and SSVC exploitation status is confirmed as 'none' at time of analysis, though the technical impact is rated 'total' by CISA's decision framework. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20511 | Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20517 | Local privilege escalation in MediaTek's geniezone Trusted Execution Environment component affects 17 Android chipsets through a use-after-free memory corruption flaw. Exploitation requires an attacker who has already obtained System-level privilege on the device, allowing them to escalate further - potentially to kernel or TEE privilege - with full confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; the September 2026 MediaTek security bulletin addresses this with Patch ID ALPS10900510. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20515 | Use-after-free in the MediaTek GPU kernel driver on chipsets MT6991 and MT8799 allows a local attacker with standard user privileges to read freed kernel or GPU memory, potentially exposing sensitive data such as pointers, credentials, or cryptographic material. The same condition may cause a full system crash, consistent with the Denial of Service tag and the 'system crash' language in the description. No public exploit has been identified and SSVC rates exploitation status as none, placing this in a lower real-world priority bracket despite the C:H rating. | MEDIUM | 5.5 | 0.1% | 28 |
No patch
|
| CVE-2026-20500 | Improper input validation in the modem firmware component of 22 MediaTek chipsets allows a local user-privileged process to trigger a system crash, resulting in a denial of service. The flaw, tracked as patch ID MOLY01810811 / MSV-9232, requires user interaction to trigger and is confined to an unprivileged local context, limiting its practical impact to availability disruption rather than data exposure or code execution. No public exploit has been identified and SSVC rates exploitation as none at this time. | MEDIUM | 5.5 | 0.1% | 28 |
No patch
|
| CVE-2026-20516 | MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5. | MEDIUM | 5.5 | 0.1% | 28 |
No patch
|
| CVE-2026-20503 | Remote denial of service against MediaTek modem firmware affects 57+ chipset variants spanning the MT6xxx and MT8xxx series when a user equipment (UE) connects to an attacker-controlled rogue base station, triggering a missing bounds check (CWE-617 reachable assertion) that crashes the modem subsystem. The attack requires no privileges or user interaction on the victim device, though the adjacent network vector (AV:A/AC:H) demands the attacker operate specialized RF equipment in physical proximity. No public exploit code has been identified, CISA KEV is not listed, and SSVC rates exploitation as none and automatable as no - consistent with a moderate real-world risk despite the broad chipset deployment footprint. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-20504 | Remote denial-of-service in MediaTek Modem firmware affects 19 chipset variants spanning the MT6xxx and MT8xxx families - when a device embedding an affected chipset connects to an attacker-controlled rogue base station, a missing bounds check (CWE-617: Reachable Assertion) in the modem subsystem triggers a system crash, causing loss of connectivity. The CVSS score of 5.3 (AV:A/AC:H) reflects the elevated operational complexity of deploying rogue cellular infrastructure to exploit this flaw. No public exploit has been identified at time of analysis, and no CISA KEV listing exists. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-20513 | Local information disclosure in MediaTek's Audio Hardware Abstraction Layer (HAL) exposes sensitive data to an attacker who has already escalated to System privilege on an affected Android device. Improper input validation (CWE-35 path-traversal class) in the audio subsystem allows a System-level process to read confidentiality-critical data it should not have access to, with no user interaction required. No public exploit code and no CISA KEV listing exist at time of analysis; SSVC assigns exploitation status 'none' and technical impact 'partial', positioning this as a post-compromise data-harvesting primitive rather than a primary attack vector. | MEDIUM | 4.4 | 0.2% | 22 |
No patch
|