Out of bounds write in MediaTek chipset battery component
Priority LOW 30CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
MediaTek chipsets MT6761, MT6765, MT6768, MT6781, MT6853 and other models are affected. The battery component performs an out of bounds write because a bounds check is missing (CWE-787). A local attacker who has already obtained System privilege can escalate privileges, and no user interaction is needed.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11276677; Issue ID: MSV-9217.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00114 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MediaTek | MediaTek chipset | MT6761; MT6765; MT6768; MT6781; MT6853; MT6858; MT6881; MT6893; MT6989; MT6991; MT6993; MT8171; MT8186; MT8188; MT8189; MT8196; MT8766; MT8768; MT8775; MT8781; MT8788E; MT8791T; MT8792; MT8796; MT8799; MT8883; MT8893; MT8910 | — | No fix listed | CNA |
- MediaTek chipset VendorMediaTek Affected MT6761; MT6765; MT6768; MT6781; MT6853; MT6858; MT6881; MT6893; MT6989; MT6991; MT6993; MT8171; MT8186; MT8188; MT8189; MT8196; MT8766; MT8768; MT8775; MT8781; MT8788E; MT8791T; MT8792; MT8796; MT8799; MT8883; MT8893; MT8910 Fixed in — No fix listed CNA
CPE configurations NVD · 56
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Show 46 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Remediation
The sources list no fixed version for MediaTek chipset.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-05 Threatist record created from CVE-2026-20529
- 2026-10-05 Alias added: GHSA-4564-cmp3-frpg
- 2026-10-06 CISA SSVC decision points changed
References
More MediaTek Mt6761 Firmware vulnerabilities
- TI-2026-16643 Heap-based buffer overflow in MediaTek chipset CVSS 3.1HIGH 8.4
- TI-2026-16642 Heap-based buffer overflow in MediaTek chipset CVSS 3.1HIGH 8.4
- TI-2026-16626 Missing authorization in MediaTek chipset CVSS 3.1HIGH 7.7
- TI-2026-16598 Out-of-bounds write in MediaTek chipset CVSS 3.1HIGH 7.8
- TI-2026-67589 Out-of-bounds write in MediaTek chipsets enables local escalation CVSS 3.1MEDIUM 6.8
- TI-2026-67578 Integer overflow in MediaTek display enables privilege escalation CVSS 3.1MEDIUM 6.7
Sources
- CVE-2026-20529 · CVE Program
- CVE-2026-20529 · NVD
- FIRST EPSS
- GHSA-4564-cmp3-frpg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences