Out-of-bounds write in MediaTek mtee enables privilege escalation
Priority LOW 30CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
MediaTek chipsets MT6768, MT6769, MT6789, MT6833, MT6855 and other models are affected by a flaw in the mtee component. A missing bounds check causes an out-of-bounds write (CWE-787). A local attacker who already holds System privilege can escalate privileges, and no user interaction is needed.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9607.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00109 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MediaTek | MediaTek chipset | MT6768; MT6769; MT6789; MT6833; MT6855; MT6877; MT8771; MT8781; MT8781X; MT8786; MT8791T | — | No fix listed | CNA |
- MediaTek chipset VendorMediaTek Affected MT6768; MT6769; MT6789; MT6833; MT6855; MT6877; MT8771; MT8781; MT8781X; MT8786; MT8791T Fixed in — No fix listed CNA
CPE configurations NVD · 50
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt2718_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt2718:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6769_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6769:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6789_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6789:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6833_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6833:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Show 40 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt6855_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6855:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6877_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6877:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8195_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8391_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8391:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8395_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8696_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8696:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8793_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Remediation
The sources list no fixed version for MediaTek chipset.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-05 Threatist record created from CVE-2026-20588
- 2026-10-05 Alias added: GHSA-xxc4-28wg-vmv2
- 2026-10-06 CISA SSVC decision points changed
- 2026-10-21 Affected versions changed · CNA
- 2026-10-30 Affected versions changed · CNA
References
More MediaTek Mt2718 Firmware vulnerabilities
- TI-2026-67591 Out-of-bounds write in MediaTek vdec enables privilege escalation CVSS 3.1HIGH 8.8
- TI-2026-16643 Heap-based buffer overflow in MediaTek chipset CVSS 3.1HIGH 8.4
- TI-2026-16642 Heap-based buffer overflow in MediaTek chipset CVSS 3.1HIGH 8.4
- TI-2026-67566 Privilege escalation in MediaTek Video HAL from missing bounds check CVSS 3.1HIGH 8.4
- TI-2026-16629 Improper check for unusual conditions in MediaTek chipset CVSS 3.1MEDIUM 6.7
- TI-2026-16594 Type confusion in MediaTek chipset CVSS 3.1MEDIUM 6.7
Sources
- CVE-2026-20588 · CVE Program
- CVE-2026-20588 · NVD
- FIRST EPSS
- GHSA-xxc4-28wg-vmv2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences