72
CVEs
0
Critical
11
High
0
KEV
0
PoC
11
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
11
MEDIUM
61
LOW
0
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-20433 | Out-of-bounds write in MediaTek modem firmware enables remote privilege escalation when devices connect to attacker-controlled rogue cellular base stations. The vulnerability affects over 60 MediaTek chipset models widely deployed in smartphones and IoT devices, exploitable by adjacent network attackers without authentication (CVSS:3.1 AV:A/PR:N). While EPSS scores this at only 6% exploitation probability (18th percentile) and no active exploitation is confirmed at time of analysis, the attack s | HIGH | 8.8 | 0.1% | 44 |
No patch
|
| CVE-2026-20501 | Heap buffer overflow in the vdec (video decoder) kernel driver across 53+ MediaTek SoCs allows a local unprivileged attacker to escalate privileges to kernel level with full system compromise. The CVSS vector (AV:L/AC:L/PR:N/UI:N) reflects that any Android app running on an affected device can trigger this flaw without special permissions or user interaction, consistent with typical Android kernel driver exposure. SSVC rates exploitation as 'none' and the attack as non-automatable, though technical impact is assessed as total; no public exploit or CISA KEV entry exists at time of analysis. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-20502 | Local privilege escalation in MediaTek's vdec (video decoder) kernel driver affects more than 53 distinct chipset variants via a heap-based out-of-bounds write stemming from a missing bounds check (CWE-122). An unprivileged local process on any affected device can trigger the flaw to achieve full kernel-level read, write, and execute access without requiring any user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the sheer breadth of affected chipsets across MediaTek's mid-range and budget device portfolio makes systematic patch deployment a significant supply-chain challenge. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-20465 | Heap-based buffer overflow in the MediaTek WLAN AP driver enables an adjacent-network attacker to escalate privileges without credentials or user interaction on chipsets MT7986, MT7916, MT7915, MT7981, and MT6890. The missing bounds check in the driver's AP-mode frame processing allows memory corruption that yields high confidentiality and integrity impact on the affected device. No public exploit has been identified and EPSS remains very low at 0.17%, though SSVC rates technical impact as total - underscoring the severity if a capable, range-proximate attacker develops working exploit code. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2026-20432 | Out-of-bounds write in MediaTek modem chipset implementations allows remote privilege escalation when user equipment connects to an attacker-controlled rogue cellular base station. Affects 57 MediaTek chipset models across MT67xx, MT68xx, MT69xx, MT87xx, and MT27xx families used in mobile devices. Authentication not required (CVSS PR:N) but requires adjacent network access and user interaction to connect to malicious base station. EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No public exploit identified at time of analysis, though vendor patch MOLY01406170 has been released per April 2026 MediaTek security bulletin. | HIGH | 8.0 | 0.1% | 40 |
No patch
|
| CVE-2026-20452 | Heap buffer overflow in the MediaTek WLAN access point driver allows adjacent-network attackers with low-privilege user execution to corrupt memory and achieve remote code execution without user interaction. The flaw affects multiple MediaTek Wi-Fi chipsets commonly embedded in routers and access points (MT7615, MT7915, MT7916, MT7981, MT7986, MT7990, MT7992, MT7993, MT6890). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.0 | 0.0% | 40 |
No patch
|
| CVE-2026-20495 | Local privilege escalation in MediaTek's Bluetooth driver affects six Wi-Fi/Bluetooth combo chipsets (MT7902, MT7920, MT7921, MT7922, MT7925, MT7927) due to a missing permission check (CWE-862) that allows a standard user-level process to invoke restricted driver operations. An attacker with low-privilege local access can fully compromise confidentiality, integrity, and availability of the affected system without any user interaction. No public exploit identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity. | HIGH | 7.8 | 0.1% | 39 |
No patch
|
| CVE-2026-20455 | Local privilege escalation in MediaTek GenieZone (trusted execution environment) allows an attacker who has already gained System-level privileges on an affected device to write out-of-bounds memory and escalate further on the chipset. The flaw affects a broad range of MediaTek chipsets used in mobile and embedded devices, with no public exploit identified at time of analysis. CVSS is 7.8 (High) reflecting the high integrity, confidentiality, and availability impact despite the local attack vector. | HIGH | 7.8 | 0.0% | 39 |
No patch
|
| CVE-2026-20483 | Privilege escalation in MediaTek's Android Telephony component enables any locally-installed application - regardless of its declared Android permissions - to invoke protected telephony operations by exploiting a missing authorization check (CWE-862). The flaw affects 35 MediaTek chipsets spanning the Helio and Dimensity families and yields high confidentiality and integrity impact over telephony functions such as call management and SMS routing. No public exploit has been identified and EPSS of 0.15% (5th percentile) indicates negligible current exploitation activity, though the zero-privilege-required nature of local exploitation lowers the attacker bar once device access is established. | HIGH | 7.7 | 0.1% | 39 |
No patch
|
| CVE-2026-20479 | Out-of-bounds read in MediaTek modem firmware across 19 chipsets enables remote denial of service when a User Equipment (UE) is connected to an attacker-controlled rogue base station. The flaw stems from a missing bounds check (CWE-125) in modem protocol processing, crashing or disrupting the modem without requiring any user interaction or device-side privileges. No active exploitation is confirmed (no CISA KEV listing), and EPSS probability is very low at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' status - though the attack is classified as automatable once rogue infrastructure is in place. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-20458 | Remote privilege escalation in the baseband modem firmware of dozens of MediaTek chipsets allows an attacker operating a rogue base station to corrupt modem memory via a missing bounds check (out-of-bounds write, CWE-787). Once a target UE camps on the attacker-controlled cell, exploitation requires no user interaction and no pre-existing privileges, potentially yielding privilege escalation within the modem subsystem. Tracked in MediaTek's July 2026 Product Security Bulletin (Patch ID MOLY01402160); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 7.5 | 0.2% | 38 |
No patch
|
| CVE-2026-20509 | Local privilege escalation in MediaTek's Power HAL component allows a process operating with System-level privileges to escalate further - potentially to root or kernel - via a stack-based out-of-bounds write caused by a missing bounds check. The vulnerability affects approximately 40 distinct MediaTek SoC models spanning multiple Android device generations. No public exploit has been identified at time of analysis, and SSVC assessment indicates exploitation is currently none, though technical impact is rated total given full C/I/A compromise post-exploitation. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20510 | Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants, allowing an attacker who has already gained System-level privilege to escalate further to higher privilege tiers without any user interaction. The flaw is confirmed by MediaTek in their September 2026 Product Security Bulletin under Patch ID ALPS11134622 and Issue ID MSV-8894. No public exploit code or active exploitation is confirmed; SSVC designates this as non-automatable with no current exploitation activity. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20462 | Heap buffer overflow in the Telephony subsystem of MediaTek chipsets enables local privilege escalation on affected Android devices, delivering full confidentiality, integrity, and availability impact. Twenty-two specific MediaTek SoC variants are confirmed affected, spanning the MT6xxx and MT8xxx mid-range and budget families. No public exploit has been identified at time of analysis; MediaTek has issued patch ALPS11006447 via their July 2026 security bulletin, but exploitation requires a pre-existing System-level privilege on the device, making this a chaining vulnerability rather than a standalone entry vector. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|
| CVE-2026-20463 | Local privilege escalation in the Modem component across 80+ MediaTek chipsets allows an attacker already holding System-level access to bypass permission enforcement (CWE-280) and escalate further within the device. The vulnerability is confirmed by MediaTek in their July 2026 Product Security Bulletin (Patch ID: MOLY01716533, Issue ID: MSV-6309) and affects a broad swath of chipsets spanning low-end to flagship tiers. No user interaction is required for exploitation, but the prerequisite of System-level access significantly constrains the realistic attack surface. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 6.7 | 0.1% | 34 |
No patch
|