CVE-2026-20436

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20436", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2025-11-03T01:30:59.011Z", "datePublished": "2026-03-02T08:39:13.985Z", "dateUpdated": "2026-03-30T13:05:41.183Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:05:41.183Z"}, "descriptions": [{"lang": "en", "value": "In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00473802; Issue ID: MSV-5970."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "defaultStatus": "unaffected", "versions": [{"version": "MT7902", "status": "affected"}, {"version": "MT7920", "status": "affected"}, {"version": "MT7921", "status": "affected"}, {"version": "MT7922", "status": "affected"}, {"version": "MT7925", "status": "affected"}, {"version": "MT7927", "status": "affected"}, {"version": "MT8696", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2026"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-120", "description": "CWE-120 Classic Buffer Overflow"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-20436"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T04:55:57.149Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-20436", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-02T13:33:56.986054Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T13:34:17.334Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "versions": [{"status": "affected", "version": "MT7902"}, {"status": "affected", "version": "MT7920"}, {"status": "affected", "version": "MT7921"}, {"status": "affected", "version": "MT7922"}, {"status": "affected", "version": "MT7925"}, {"status": "affected", "version": "MT7927"}, {"status": "affected", "version": "MT8696"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2026"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00473802; Issue ID: MSV-5970."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Classic Buffer Overflow"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:05:41.183Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20436", "state": "PUBLISHED", "dateUpdated": "2026-03-30T13:05:41.183Z", "dateReserved": "2025-11-03T01:30:59.011Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2026-03-02T08:39:13.985Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaTek chipset", "vendor": "MediaTek, Inc.", "versions": [{"status": "affected", "version": "MT7902"}, {"status": "affected", "version": "MT7920"}, {"status": "affected", "version": "MT7921"}, {"status": "affected", "version": "MT7922"}, {"status": "affected", "version": "MT7925"}, {"status": "affected", "version": "MT7927"}, {"status": "affected", "version": "MT8696"}]}], "source": "security@mediatek.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:nbiot_sdk:*:*:*:*:*:*:*:*", "matchCriteriaId": "513F2D0C-0D1C-4C90-AA0F-4F43BF08EB0C", "versionEndIncluding": "3.8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7902:-:*:*:*:*:*:*:*", "matchCriteriaId": "91DEA745-47A8-43F1-A1B2-F53F651A99EF", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7920:-:*:*:*:*:*:*:*", "matchCriteriaId": "140DAC08-96E9-47D3-BC2E-65E999DCFD50", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7921:-:*:*:*:*:*:*:*", "matchCriteriaId": "32AFEA0A-FFE2-4EA9-8B51-7E3E75DE65CC", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7922:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA2A6813-7138-441E-A9E4-FF62FCBD797A", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7925:-:*:*:*:*:*:*:*", "matchCriteriaId": "27CFC9DF-2F4C-469A-8A19-A260B1134CFE", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt7927:-:*:*:*:*:*:*:*", "matchCriteriaId": "05525018-AFE0-415C-A71C-A77922C7D637", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:*", "matchCriteriaId": "26573298-76BC-49FE-8D99-CF03ED01B185", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00473802; Issue ID: MSV-5970."}, {"lang": "es", "value": "En el controlador STA de WLAN, existe una posible escalada de privilegios debido a una falta de verificaci\u00f3n de l\u00edmites. Esto podr\u00eda llevar a una escalada de privilegios local si un actor malintencionado ya ha obtenido el privilegio de Sistema. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n. ID del parche: WCNCR00473802; ID del problema: MSV-5970."}], "id": "CVE-2026-20436", "lastModified": "2026-06-17T10:17:26.720", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20436", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-02T09:16:16.743", "references": [{"source": "security@mediatek.com", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/March-2026"}], "sourceIdentifier": "security@mediatek.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "security@mediatek.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8696", "source": "cna", "vendor": "MediaTek, Inc."}, "product": "mt7902", "vendor": "mediatek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8696", "source": "cna", "vendor": "MediaTek, Inc."}, "product": "mt7920", "vendor": "mediatek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8696", "source": "cna", "vendor": "MediaTek, Inc."}, "product": "mt7921", "vendor": "mediatek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8696", "source": "cna", "vendor": "MediaTek, Inc."}, "product": "mt7922", "vendor": "mediatek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8696", "source": "cna", "vendor": "MediaTek, Inc."}, "product": "mt7925", "vendor": "mediatek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8696", "source": "cna", "vendor": "MediaTek, Inc."}, "product": "mt7927", "vendor": "mediatek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, MT8696", "source": "cna", "vendor": "MediaTek, Inc."}, "product": "mt8696", "vendor": "mediatek"}], "analysis": {"en": {"generated_at": "2026-04-16T05:54:51.197263+00:00", "value": {"mitigation_remediation": ["Apply the vendor-supplied patch WCNCR00473802 to the MediaTek WLAN STA driver to eliminate the bounds\u2011check flaw.", "Disable the WLAN STA functionality or the driver module on affected devices until the patch is deployed to prevent the vulnerability from being exploitable.", "Reduce local system privileges to the minimum required for legitimate users and processes, limiting the potential impact of any future local exploitation."], "summary": {"action": "Apply Patch", "impact": "Escalation of Privilege"}, "threat_synthesis": {"affected_systems": "The flaw affects MediaTek chipsets that implement the WLAN STA driver, including models MT7902, MT7920, MT7921, MT7922, MT7925, MT7927, and MT8696. The CVE source does not list specific firmware or driver version numbers, so any device using the affected driver code is potentially vulnerable.", "description_and_impact": "A missing bounds check in the MediaTek WLAN STA driver allows a malicious actor who already holds system-level privileges to incrementally raise their own privileges without requiring any further user interaction. This flaw can be exploited locally on devices running the affected driver code, potentially granting the attacker full control over the system. The vulnerability is a classic buffer overflow, categorized under CWE\u2011120, which can corrupt memory and bypass access controls.", "risk_and_exploitability": "The CVSS score of 6.7 indicates medium severity for local privilege escalation. Exploitation requires an attacker to already have system-level privileges on the target device, which may result from an earlier compromise or hard\u2011coded vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Once the escalation is achieved, the attacker could fully compromise the device, for example by modifying firmware, installing malicious software, or executing arbitrary commands."}}}}, "created": "2026-03-03T08:45:47.320366+00:00", "title": "Local Privilege Escalation via Missing Bounds Check in MediaTek WLAN STA Driver", "updated": "2026-04-16T06:00:10.150827+00:00", "vendors": ["mediatek", "mediatek$PRODUCT$mt7902", "mediatek$PRODUCT$mt7920", "mediatek$PRODUCT$mt7921", "mediatek$PRODUCT$mt7922", "mediatek$PRODUCT$mt7925", "mediatek$PRODUCT$mt7927", "mediatek$PRODUCT$mt8696"]}