MediaTek November Bulletin Covers Modem and Chipset Vulnerabilities
Tech GuruP1 — VALIDATE AND UPDATEMedium to Critical · Not provided by the authorityEXPLOITATION: NOT PUBLICLY REPORTED
Quick Answer
Device and embedded-system owners should map each model and firmware build to the bulletin’s chipset and software ranges, obtain the manufacturer-supported update, and validate device operation. MediaTek reports no known active exploitation.
Confirm Scope And Apply The Supported Remediation
What to do now: Record device models, MediaTek chipset identifiers, operating-system or modem software, installed firmware, manufacturer support status and operational owners. Match each device to the bulletin’s exact chipset and software-version columns. A MediaTek component alone does not establish that a device is affected or patched. Obtain the OEM’s advisory and supported firmware containing the relevant MediaTek fixes, stage deployment, and track devices whose manufacturers have not yet confirmed a fix. Confirm the installed manufacturer firmware and patch coverage; test cellular connectivity, location, audio, graphics and required enterprise applications, and retain OEM confirmations and deployment evidence.
Last verified: 2026-11-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Advisory-listed MediaTek chipsets and modem, GNSS, audio, GPU, USB, display and AI components |
|---|---|
| Advisory | MediaTek November 2026 Security Bulletin |
| CVEs | CVE-2026-20499, CVE-2026-20545, CVE-2026-20546, CVE-2026-20547, CVE-2026-20548, CVE-2026-20549, CVE-2026-20550, CVE-2026-20551, CVE-2026-20552, CVE-2026-20553, CVE-2026-20554, CVE-2026-20555, CVE-2026-20556, CVE-2026-20557, CVE-2026-20558, CVE-2026-20559, CVE-2026-20560, CVE-2026-20561, CVE-2026-20562, CVE-2026-20563, CVE-2026-20564, CVE-2026-20565, CVE-2026-20566, CVE-2026-20567, CVE-2026-20568, CVE-2026-20569, CVE-2026-20570, CVE-2026-20571, CVE-2026-20572, CVE-2026-20573, CVE-2026-20574, CVE-2026-20575, CVE-2026-20576, CVE-2026-20577, CVE-2026-20578, CVE-2026-20580, CVE-2026-20581, CVE-2026-20582, CVE-2026-20583, CVE-2026-20584, CVE-2026-20585, CVE-2026-20590, CVE-2026-20591, CVE-2026-20592, CVE-2026-20593, CVE-2026-20594, CVE-2026-20595, CVE-2026-20596, CVE-2026-20597, CVE-2026-20598, CVE-2026-20599, CVE-2026-20600, CVE-2026-68588, CVE-2026-68589, CVE-2026-68590, CVE-2026-68591 |
| Authoritative release date | 2026-11-02 (MediaTek publishes a date without a time) |
| Authority revision date | Version 1.0, 2026-11-02; initial bulletin publication. |
| Affected versions | Only the chipset and software-version combinations listed for each CVE in the November bulletin; confirm the device manufacturer and firmware mapping before assigning applicability. |
| Fixed version | Device-manufacturer firmware containing the MediaTek patches; the bulletin says OEMs received patches at least two months before publication and does not name a universal consumer firmware build |
| CVSS base score | Not provided by the authority |
| CVSS severity | Medium to Critical |
| Exploitation status | MediaTek states it is not aware of active exploitation of these vulnerabilities in the wild.; no exploitation claim is inferred. |
Authority-Specific Scope And Version Evidence
| CVE-2026-20499 | Subcomponent: Modem; Severity: Critical; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982VB, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8666, MT8667, MT8668, MT8673, MT8675, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893; Report Source: External |
|---|---|
| CVE-2026-20545 | Subcomponent: Modem; Severity: Critical; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20546 | Subcomponent: Modem; Severity: Critical; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20547 | Subcomponent: Modem; Severity: Critical; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20548 | Subcomponent: Modem; Severity: Critical; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20549 | Subcomponent: Modem; Severity: Critical; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20550 | Subcomponent: gnss; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2735, MT2737, MT6880, MT6890, MT6980D, MT6982, MT6986, MT6988, MT6990; Report Source: External |
| CVE-2026-20551 | Subcomponent: gnss; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2737, MT6813, MT6980D, MT6982, MT6986, MT6988, MT6990; Report Source: External |
| CVE-2026-20552 | Subcomponent: ccci; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2735, MT2737, MT6813, MT6880, MT6890, MT6980D, MT6982, MT6986, MT6988, MT6990; Report Source: External |
| CVE-2026-20553 | Subcomponent: DA; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2713, MT2718, MT2737, MT6781, MT6789, MT6813, MT6835, MT6855, MT6858, MT6878, MT6879, MT6880, MT6881, MT6886, MT6890, MT6895, MT6897, MT6899, MT6982VB, MT6983, MT6985, MT6986, MT6989, MT6990, MT6991, MT8188, MT8189, MT8370, MT8390, MT8676, MT8678; Report Source: External |
| CVE-2026-20554 | Subcomponent: Modem; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: External |
| CVE-2026-20555 | Subcomponent: Modem; Severity: High; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-20556 | Subcomponent: Modem; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20557 | Subcomponent: Modem; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-20558 | Subcomponent: GPU pdma; Severity: High; CWE: CWE-416 Use After Free; Affected Chipsets: MT6993, MT8910; Report Source: External |
| CVE-2026-20559 | Subcomponent: GPU pdma; Severity: High; CWE: CWE-416 Use After Free; Affected Chipsets: MT6993, MT8910; Report Source: External |
| CVE-2026-20560 | Subcomponent: Modem; Severity: High; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT6835, MT6878, MT6897, MT6899, MT8676, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883; Report Source: External |
| CVE-2026-20561 | Subcomponent: Modem; Severity: High; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20562 | Subcomponent: Modem; Severity: High; CWE: CWE-1284 Improper Validation of Specified Quantity in Input; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20563 | Subcomponent: Modem; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8781, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20564 | Subcomponent: Modem; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20565 | Subcomponent: Modem; Severity: High; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20566 | Subcomponent: Modem; Severity: Medium; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8676, MT8678, MT8791; Report Source: External |
| CVE-2026-20567 | Subcomponent: afe; Severity: Medium; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT6739, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793; Report Source: External |
| CVE-2026-20568 | Subcomponent: afe; Severity: Medium; CWE: CWE-416 Use After Free; Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793; Report Source: External |
| CVE-2026-20569 | Subcomponent: adsp; Severity: Medium; CWE: CWE-416 Use After Free; Affected Chipsets: MT6858, MT6878, MT6881, MT6897, MT6899, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678; Report Source: External |
| CVE-2026-20570 | Subcomponent: adsp; Severity: Medium; CWE: CWE-416 Use After Free; Affected Chipsets: MT6858, MT6878, MT6881, MT6897, MT6899, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678; Report Source: External |
| CVE-2026-20571 | Subcomponent: afe; Severity: Medium; CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'); Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793; Report Source: External |
| CVE-2026-20572 | Subcomponent: adsp; Severity: Medium; CWE: CWE-191 Integer Underflow (Wrap or Wraparound); Affected Chipsets: MT6858, MT6878, MT6881, MT6897, MT6899, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793; Report Source: External |
| CVE-2026-20573 | Subcomponent: afe; Severity: Medium; CWE: CWE-415 Double Free; Affected Chipsets: MT2735, MT2737, MT6768, MT6781, MT6789, MT6853, MT6855, MT6877, MT6878, MT6885, MT6886, MT6890, MT6895, MT6897, MT6899, MT6980D, MT6985, MT6988, MT6989, MT6990, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793; Report Source: External |
| CVE-2026-20574 | Subcomponent: afe; Severity: Medium; CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'); Affected Chipsets: MT2735, MT2737, MT6768, MT6781, MT6789, MT6853, MT6855, MT6877, MT6878, MT6885, MT6886, MT6890, MT6895, MT6897, MT6899, MT6980D, MT6985, MT6988, MT6989, MT6990, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793; Report Source: External |
| CVE-2026-20575 | Subcomponent: afe; Severity: Medium; CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion'); Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993; Report Source: External |
| CVE-2026-20576 | Subcomponent: afe; Severity: Medium; CWE: CWE-191 Integer Underflow (Wrap or Wraparound); Affected Chipsets: MT6789, MT6835, MT6855, MT6858, MT6877, MT6885, MT6886, MT6895, MT6897, MT6985, MT6988, MT6989, MT6991, MT6993; Report Source: External |
| CVE-2026-20577 | Subcomponent: Modem; Severity: Medium; CWE: CWE-280 Improper Handling of Insufficient Permissions or Privileges; Affected Chipsets: MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-20578 | Subcomponent: Modem; Severity: Medium; CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'); Affected Chipsets: MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-20580 | Subcomponent: usb; Severity: Medium; CWE: CWE-416 Use After Free; Affected Chipsets: MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6889, MT6890, MT6893, MT6897, MT6985, MT6988, MT6989, MT6990, MT6991, MT6993, MT8188, MT8189, MT8196, MT8668, MT8768, MT8786; Report Source: External |
| CVE-2026-20581 | Subcomponent: usb; Severity: Medium; CWE: CWE-416 Use After Free; Affected Chipsets: MT6858, MT6881, MT6993, MT8188, MT8189, MT8518S, MT8532, MT8668; Report Source: External |
| CVE-2026-20582 | Subcomponent: usb; Severity: Medium; CWE: CWE-415 Double Free; Affected Chipsets: MT6993, MT8188, MT8189, MT8518S, MT8532, MT8668; Report Source: External |
| CVE-2026-20583 | Subcomponent: usb; Severity: Medium; CWE: CWE-416 Use After Free; Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8188, MT8189, MT8196, MT8668, MT8768, MT8786; Report Source: External |
| CVE-2026-20584 | Subcomponent: usb; Severity: Medium; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993; Report Source: External |
| CVE-2026-20585 | Subcomponent: Modem; Severity: Medium; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2718, MT2737, MT6813, MT6815, MT6835, MT6858, MT6878, MT6879, MT6881, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8186, MT8188, MT8189, MT8195, MT8196, MT8367, MT8391, MT8676, MT8678; Report Source: Internal |
| CVE-2026-20590 | Subcomponent: display; Severity: Medium; CWE: CWE-121 Stack-based Buffer Overflow; Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8188, MT8668, MT8676, MT8678, MT8793; Report Source: External |
| CVE-2026-20591 | Subcomponent: GPU pdma; Severity: Medium; CWE: CWE-416 Use After Free; Affected Chipsets: MT6993, MT8910; Report Source: External |
| CVE-2026-20592 | Subcomponent: Modem; Severity: Medium; CWE: CWE-532 Insertion of Sensitive Information into Log File; Affected Chipsets: MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-20593 | Subcomponent: Modem; Severity: Medium; CWE: CWE-617 Reachable Assertion; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20594 | Subcomponent: Modem; Severity: Medium; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20595 | Subcomponent: neuropilot; Severity: Medium; CWE: CWE-1286 Improper Validation of Syntactic Correctness of Input; Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8188, MT8189, MT8321, MT8385, MT8696, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8791T, MT8793, MT8797, MT8798, MT8875, MT8910, MT8911; Report Source: External |
| CVE-2026-20596 | Subcomponent: Modem; Severity: Medium; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20597 | Subcomponent: Modem; Severity: Medium; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20598 | Subcomponent: Modem; Severity: Medium; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-20599 | Subcomponent: Modem; Severity: Medium; CWE: CWE-280 Improper Handling of Insufficient Permissions or Privileges; Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-20600 | Subcomponent: Modem; Severity: Medium; CWE: CWE-617 Reachable Assertion; Affected Chipsets: MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-68588 | Subcomponent: Modem; Severity: Medium; CWE: CWE-190 Integer Overflow or Wraparound; Affected Chipsets: MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883; Report Source: Internal |
| CVE-2026-68589 | Subcomponent: Modem; Severity: Medium; CWE: CWE-787 Out-of-bounds Write; Affected Chipsets: MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-68590 | Subcomponent: ip_stack; Severity: Medium; CWE: CWE-125 Out-of-bounds Read; Affected Chipsets: MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893; Report Source: Internal |
| CVE-2026-68591 | Subcomponent: ccci; Severity: Medium; CWE: CWE-732 Incorrect Permission Assignment for Critical Resource; Affected Chipsets: MT2737, MT6813, MT6815, MT6835, MT6878, MT6879, MT6886, MT6895, MT6896, MT6897, MT6980, MT6983, MT6985, MT6990, MT8676, MT8755, MT8775, MT8792, MT8798, MT8863, MT8873, MT8883; Report Source: Internal |
What Changed
MediaTek published 56 chipset vulnerabilities, including six Critical modem issues. The bulletin supplies per-CVE chipset and software scope and directs remediation through device manufacturers.
What To Validate Now
- Inventory. Record device models, MediaTek chipset identifiers, operating-system or modem software, installed firmware, manufacturer support status and operational owners.
- Establish applicability. Match each device to the bulletin’s exact chipset and software-version columns. A MediaTek component alone does not establish that a device is affected or patched.
- Remediate. Obtain the OEM’s advisory and supported firmware containing the relevant MediaTek fixes, stage deployment, and track devices whose manufacturers have not yet confirmed a fix.
- Validate. Confirm the installed manufacturer firmware and patch coverage; test cellular connectivity, location, audio, graphics and required enterprise applications, and retain OEM confirmations and deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The bulletin provides severity categories but no numeric CVSS base scores. Do not substitute a third-party score or invent a common fixed version. Coordinate updates for embedded devices and preserve a supported recovery procedure.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
