Out of bounds write and read in MediaTek ccci component
Priority LOW 30CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
MediaTek chipsets MT2735, MT2737, MT6813, MT6880, MT6890 and other models contain a flaw in the ccci component. A missing bounds check causes out of bounds writes and reads (CWE-787). A local attacker who already has System privilege and a user interaction can cause information disclosure, memory corruption, crashes or privilege escalation.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS11428950 (Note: For MT6880, MT6890) / ALPS10563453 (Note: For MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988) / AUTO00858766 (Note: For MT2735, MT2737); Issue ID: MSV-9893.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00119 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MediaTek | MediaTek chipset | MT2735; MT2737; MT6813; MT6880; MT6890; MT6980D; MT6986; MT6986D; MT6988; MT6990 | — | No fix listed | CNA |
- MediaTek chipset VendorMediaTek Affected MT2735; MT2737; MT6813; MT6880; MT6890; MT6980D; MT6986; MT6986D; MT6988; MT6990 Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt2735_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt2735:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt2737_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt2737:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6880_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6880:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt6980d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6986d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6986d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt6980d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6980d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6986_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6986:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6986d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6986d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Remediation
The sources list no fixed version for MediaTek chipset.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-05 Threatist record created from CVE-2026-20528
- 2026-10-05 Alias added: GHSA-4qxx-g536-wh52
- 2026-10-06 CISA SSVC decision points changed
References
More MediaTek Mt2735 Firmware vulnerabilities
- TI-2026-16622 Out-of-bounds read in MediaTek chipset CVSS 3.1HIGH 7.5
- TI-2026-16576 Out-of-bounds write in MediaTek chipset CVSS 3.1HIGH 8.8
- TI-2026-16575 Out-of-bounds write in MediaTek chipset CVSS 3.1HIGH 8.0
- TI-2026-67565 Out-of-bounds write in MediaTek modem could allow privilege escalation CVSS 3.1HIGH 7.5
- TI-2026-67564 Out-of-bounds write in MediaTek modem chipsets enables escalation CVSS 3.1HIGH 7.5
- TI-2026-67571 Out-of-bounds write in MediaTek modem chipsets CVSS 3.1HIGH 7.1
Sources
- CVE-2026-20528 · CVE Program
- CVE-2026-20528 · NVD
- FIRST EPSS
- GHSA-4qxx-g536-wh52 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences