Out-of-bounds write in MediaTek MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT6739…

Not available: CISA has not published SSVC decision points for this record.

• MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT6739, MT6750, MT6750S, MT6755, MT6757, MT6757P, MT6758, MT6761, MT6762, MT6762D, MT6762M, MT6763, MT6765, MT6765T, MT6767, MT6768, MT6769, MT6769T, MT6769Z, MT6771, MT6775, MT6779, MT6781, MT6783, MT6785, MT6785T, MT6789, MT6797, MT6799, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6889, MT6890, MT6891, MT6893, MT6895, MT6983, MT8666, MT8667, MT8675, MT8735A, MT8735B, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8789, MT8791, MT8797 VendorMediaTek Affected Modem LR9, LR11, LR12, LR12A, LR13, NR15, NR16 Fixed in — No fix listed CNA

No fixed version listed by the sources yet.

1. 2026-10-02 Threatist record created from CVE-2022-20083
2. 2026-10-03 Alias added: GHSA-w5h3-hfjg-f58j

• TI-2022-06117 Out-of-bounds write in MediaTek MT2731, MT2735, MT6297, MT6725, MT6735, MT6737, MT6739… CVSS 3.1CRITICAL 9.8
• TI-2023-07238 Out-of-bounds write in MediaTek MT2731, MT6570, MT6580, MT6595, MT6732, MT6735, MT6737… CVSS 3.1CRITICAL 9.8
• TI-2021-17332 In Modem EMM, there is a possible information disclosure due to a missing data encryption. CVSS 3.1HIGH 7.5

• CVE-2022-20083 · CVE Program
• CVE-2022-20083 · NVD
• FIRST EPSS
• GHSA-w5h3-hfjg-f58j · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences