TI-2023-07260 Aliases CVE-2023-20841 GHSA-ggph-7x4f-rj7j

Out-of-bounds write in MediaTek MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395…

LOW 30CWE-787Published 2023-09-04 · Updated 2024-10-21

Key facts

Attack vector: Local
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

In imgsys, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326441.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00103 0th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MediaTek	MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8673	Android 11.0, 12.0 / Linux 6.1 / IOT-v23.0 / Yocto 4.0	—	No fix listed	CNA

MT2713, MT6895, MT6897, MT6983, MT8188, MT8195, MT8395, MT8673 VendorMediaTek Affected Android 11.0, 12.0 / Linux 6.1 / IOT-v23.0 / Yocto 4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:yocto:4.0:::::::*	4.0	Vulnerable	backstage
cpe:2.3:a:mediatek:iot_yocto:23.0:::::::*	23.0	Vulnerable	MediaTek
cpe:2.3:o:google:android:11.0:::::::*	11.0	Vulnerable	Google
cpe:2.3:o:google:android:12.0:::::::*	12.0	Vulnerable	Google
cpe:2.3:o:linux:linux_kernel:6.1:-::::::	6.1	Vulnerable	Linux
cpe:2.3:h:mediatek:mt2713:-:::::::*	not specified by NVD	Running on	MediaTek
cpe:2.3:h:mediatek:mt6895:-:::::::*	not specified by NVD	Running on	MediaTek
cpe:2.3:h:mediatek:mt6897:-:::::::*	not specified by NVD	Running on	MediaTek
cpe:2.3:h:mediatek:mt6983:-:::::::*	not specified by NVD	Running on	MediaTek
cpe:2.3:h:mediatek:mt8188:-:::::::*	not specified by NVD	Running on	MediaTek

cpe:2.3:a:linuxfoundation:yocto:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·backstage
cpe:2.3:a:mediatek:iot_yocto:23.0:*:*:*:*:*:*:* Versions 23.0 Vulnerable ·MediaTek
cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Google
cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Google
cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:* Versions 6.1 Vulnerable ·Linux
cpe:2.3:h:mediatek:mt2713:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:h:mediatek:mt8195:-:::::::*	not specified by NVD	Running on	MediaTek
cpe:2.3:h:mediatek:mt8395:-:::::::*	not specified by NVD	Running on	MediaTek
cpe:2.3:h:mediatek:mt8673:-:::::::*	not specified by NVD	Running on	MediaTek

cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-20841
2026-10-03 Alias added: GHSA-ggph-7x4f-rj7j

References

Advisory 1

https://corp.mediatek.com/product-security-bulletin/September-2023

TI-2024-13132 Out-of-bounds write in MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT8365… CVSS 3.1CRITICAL 9.8
TI-2023-16072 Improper input validation in MediaTek MT5221, MT6781, MT6833, MT6853, MT6853T, MT6855… CVSS 3.1HIGH 7.5
TI-2025-14790 Out-of-bounds write in MediaTek MT6886, MT6897, MT6899, MT6985, MT6989, MT6991, MT8195… CVSS 3.1HIGH 7.8
TI-2023-16081 Integer overflow in MediaTek MT6879, MT6886, MT6891, MT6895, MT6896, MT6983, MT6985… CVSS 3.1MEDIUM 6.7
TI-2023-16080 Integer overflow in MediaTek MT6771, MT6779, MT6785, MT6853, MT6853T, MT6873, MT6877… CVSS 3.1MEDIUM 6.7
TI-2023-16063 Improper input validation in MediaTek MT2713, MT6779, MT6781, MT6785, MT6789, MT6833… CVSS 3.1MEDIUM 6.7

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences