CVE-2026-20408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20408", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2025-11-03T01:30:59.008Z", "datePublished": "2026-02-02T08:14:56.694Z", "dateUpdated": "2026-03-30T13:02:57.756Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:02:57.756Z"}, "descriptions": [{"lang": "en", "value": "In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "defaultStatus": "unaffected", "versions": [{"version": "MT6890", "status": "affected"}, {"version": "MT7615", "status": "affected"}, {"version": "MT7915", "status": "affected"}, {"version": "MT7916", "status": "affected"}, {"version": "MT7981", "status": "affected"}, {"version": "MT7986", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap Overflow"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-20408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T04:55:40.470235Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:39.421Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-20408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T04:55:40.470235Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T14:02:20.563Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "versions": [{"status": "affected", "version": "MT6890"}, {"status": "affected", "version": "MT7615"}, {"status": "affected", "version": "MT7915"}, {"status": "affected", "version": "MT7916"}, {"status": "affected", "version": "MT7981"}, {"status": "affected", "version": "MT7986"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap Overflow"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:02:57.756Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20408", "state": "PUBLISHED", "dateUpdated": "2026-03-30T13:02:57.756Z", "dateReserved": "2025-11-03T01:30:59.008Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2026-02-02T08:14:56.694Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaTek chipset", "vendor": "MediaTek, Inc.", "versions": [{"status": "affected", "version": "MT6890"}, {"status": "affected", "version": "MT7615"}, {"status": "affected", "version": "MT7915"}, {"status": "affected", "version": "MT7916"}, {"status": "affected", "version": "MT7981"}, {"status": "affected", "version": "MT7986"}]}], "source": "security@mediatek.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DD86CC1-BD46-42D2-9112-190CCAC96B30", "versionEndIncluding": "7.6.7.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:openwrt:openwrt:19.07.0:-:*:*:*:*:*:*", "matchCriteriaId": "4FA469E2-9E63-4C9A-8EBA-10C8C870063A", "vulnerable": true}, {"criteria": "cpe:2.3:o:openwrt:openwrt:21.02.0:-:*:*:*:*:*:*", "matchCriteriaId": "F0133207-2EED-4625-854F-8DB7770D5BF7", "vulnerable": true}, {"criteria": "cpe:2.3:o:openwrt:openwrt:23.05.0:-:*:*:*:*:*:*", "matchCriteriaId": "00113669-2850-4F0C-913A-92CA5290746E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*", "matchCriteriaId": "171D1C08-F055-44C0-913C-AA2B73AF5B72", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7615:-:*:*:*:*:*:*:*", "matchCriteriaId": "05748BB1-0D48-4097-932E-E8E2E574FD8D", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7915:-:*:*:*:*:*:*:*", "matchCriteriaId": "3AB22996-9C22-4B6C-9E94-E4C055D16335", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7916:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD5AA441-5381-4179-89EB-1642120F72B4", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7981:-:*:*:*:*:*:*:*", "matchCriteriaId": "490CD97B-021F-4350-AEE7-A2FA866D5889", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7986:-:*:*:*:*:*:*:*", "matchCriteriaId": "40A9E917-4B34-403F-B512-09EEBEA46811", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758."}, {"lang": "es", "value": "En WLAN, existe una posible escritura fuera de l\u00edmites debido a un desbordamiento de b\u00fafer en el heap. Esto podr\u00eda conducir a una escalada de privilegios remota (pr\u00f3xima/adyacente) sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se requiere interacci\u00f3n del usuario para la explotaci\u00f3n. ID del parche: WCNCR00461651; ID del problema: MSV-4758."}], "id": "CVE-2026-20408", "lastModified": "2026-06-17T10:17:22.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20408", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T04:55:40.470235Z", "version": "2.0.3"}}]}, "published": "2026-02-02T09:15:55.657", "references": [{"source": "security@mediatek.com", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "sourceIdentifier": "security@mediatek.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "security@mediatek.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T17:34:10.188172+00:00", "value": {"mitigation_remediation": ["Apply MediaTek firmware patch WCNCR00461651 to resolve the buffer overflow in WLAN functionality.", "If a firmware update is unavailable, disable or tightly restrict WLAN services to prevent untrusted wireless traffic from reaching the vulnerable component.", "Monitor device logs for abnormal access patterns and conduct routine security audits of wireless configurations."], "summary": {"action": "Apply Patch", "impact": "Remote Privilege Escalation"}, "threat_synthesis": {"affected_systems": "MediaTek chipsets including the MT6890, MT7615, MT7915, MT7916, MT7981, and MT7986 are affected, as well as the MediaTek Software Development Kit. Embedded devices running OpenWrt 19.07.0, 21.02.0, and 23.05.0 that incorporate these chipsets are also susceptible.", "description_and_impact": "A heap buffer overflow in the wireless LAN component of MediaTek chipsets allows an attacker to perform an out\u2011of\u2011bounds write. The vulnerability is triggered without any user interaction and can lead to remote (proximal/adjacent) privilege escalation, granting the attacker higher privileges on the affected device. The flaw is identified as both CWE\u2011122 (Heap-Based Buffer Overflow) and CWE\u2011787 (Out\u2011of\u2011Bounds Write).", "risk_and_exploitability": "The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. Attackers likely require proximity to the wireless network or adjacent network components to exploit the flaw, possibly through malicious packets or manipulation of wireless management traffic. No additional privileges or user interaction are needed once the vulnerable state is reached."}}}}, "created": "2026-02-04T12:44:47.634829+00:00", "title": "Remote WLAN Heap Buffer Overflow in MediaTek Chipsets", "updated": "2026-04-16T17:45:27.369033+00:00", "vendors": ["mediatek", "mediatek$PRODUCT$mt6890", "mediatek$PRODUCT$mt7615", "mediatek$PRODUCT$mt7915", "mediatek$PRODUCT$mt7916", "mediatek$PRODUCT$mt7981", "mediatek$PRODUCT$mt7986"]}