Hero Banner DESKTOP 1920X677

    November 2026
    Product Security Bulletin

    Published 2026-11-02

    The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting certain MediaTek chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication. We take the security of our chipsets and our customers' products very seriously. At this time, we are not aware of any active exploitation of these vulnerabilities in the wild.
    The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).
    The MediaTek Product Security Bulletin contains details of security vulnerabilities affecting certain MediaTek chipsets. Device OEMs have been notified of all the issues and the corresponding security patches for at least two months before publication. We take the security of our chipsets and our customers' products very seriously. At this time, we are not aware of any active exploitation of these vulnerabilities in the wild.

    The severity of the identified vulnerabilities was conducted based on the Common Vulnerability Scoring System version 3.1 (CVSS v3.1).

    Summary

    Severity CVEs
    Critical CVE-2026-20499, CVE-2026-20545, CVE-2026-20546, CVE-2026-20547, CVE-2026-20548, CVE-2026-20549
    High CVE-2026-20550, CVE-2026-20551, CVE-2026-20552, CVE-2026-20553, CVE-2026-20554, CVE-2026-20555, CVE-2026-20556, CVE-2026-20557, CVE-2026-20558, CVE-2026-20559, CVE-2026-20560, CVE-2026-20561, CVE-2026-20562, CVE-2026-20563, CVE-2026-20564, CVE-2026-20565
    Medium CVE-2026-20566, CVE-2026-20567, CVE-2026-20568, CVE-2026-20569, CVE-2026-20570, CVE-2026-20571, CVE-2026-20572, CVE-2026-20573, CVE-2026-20574, CVE-2026-20575, CVE-2026-20576, CVE-2026-20577, CVE-2026-20578, CVE-2026-20580, CVE-2026-20581, CVE-2026-20582, CVE-2026-20583, CVE-2026-20584, CVE-2026-20585, CVE-2026-20590, CVE-2026-20591, CVE-2026-20592, CVE-2026-20593, CVE-2026-20594, CVE-2026-20595, CVE-2026-20596, CVE-2026-20597, CVE-2026-20598, CVE-2026-20599, CVE-2026-20600, CVE-2026-68588, CVE-2026-68589, CVE-2026-68590, CVE-2026-68591

    Details

    CVE CVE-2026-20499
    Subcomponent Modem
    Severity Critical
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982VB, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8666, MT8667, MT8668, MT8673, MT8675, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893
    Report Source External

    CVE CVE-2026-20545
    Subcomponent Modem
    Severity Critical
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20546
    Subcomponent Modem
    Severity Critical
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to an incorrect bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20547
    Subcomponent Modem
    Severity Critical
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20548
    Subcomponent Modem
    Severity Critical
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to an integer overflow.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20549
    Subcomponent Modem
    Severity Critical
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to improper input validation.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20550
    Subcomponent gnss
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2735, MT2737, MT6880, MT6890, MT6980D, MT6982, MT6986, MT6988, MT6990
    Report Source External

    CVE CVE-2026-20551
    Subcomponent gnss
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2737, MT6813, MT6980D, MT6982, MT6986, MT6988, MT6990
    Report Source External

    CVE CVE-2026-20552
    Subcomponent ccci
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2735, MT2737, MT6813, MT6880, MT6890, MT6980D, MT6982, MT6986, MT6988, MT6990
    Report Source External

    CVE CVE-2026-20553
    Subcomponent DA
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2713, MT2718, MT2737, MT6781, MT6789, MT6813, MT6835, MT6855, MT6858, MT6878, MT6879, MT6880, MT6881, MT6886, MT6890, MT6895, MT6897, MT6899, MT6982VB, MT6983, MT6985, MT6986, MT6989, MT6990, MT6991, MT8188, MT8189, MT8370, MT8390, MT8676, MT8678
    Report Source External

    CVE CVE-2026-20554
    Subcomponent Modem
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible system crash due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source External

    CVE CVE-2026-20555
    Subcomponent Modem
    Severity High
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible out of bounds read due to a missing bounds check.
    Affected Chipsets MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-20556
    Subcomponent Modem
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20557
    Subcomponent Modem
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-20558
    Subcomponent GPU pdma
    Severity High
    CWE CWE-416 Use After Free
    Description There is a possible escalation of privilege due to use after free.
    Affected Chipsets MT6993, MT8910
    Report Source External

    CVE CVE-2026-20559
    Subcomponent GPU pdma
    Severity High
    CWE CWE-416 Use After Free
    Description There is a possible memory corruption due to use after free.
    Affected Chipsets MT6993, MT8910
    Report Source External

    CVE CVE-2026-20560
    Subcomponent Modem
    Severity High
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible system crash due to improper input validation.
    Affected Chipsets MT2716, MT6835, MT6878, MT6897, MT6899, MT8676, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883
    Report Source External

    CVE CVE-2026-20561
    Subcomponent Modem
    Severity High
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20562
    Subcomponent Modem
    Severity High
    CWE CWE-1284 Improper Validation of Specified Quantity in Input
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20563
    Subcomponent Modem
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to an incorrect bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8781, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20564
    Subcomponent Modem
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to an incorrect bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20565
    Subcomponent Modem
    Severity High
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to an incorrect bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20566
    Subcomponent Modem
    Severity Medium
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8676, MT8678, MT8791
    Report Source External

    CVE CVE-2026-20567
    Subcomponent afe
    Severity Medium
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT6739, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793
    Report Source External

    CVE CVE-2026-20568
    Subcomponent afe
    Severity Medium
    CWE CWE-416 Use After Free
    Description There is a possible system crash due to use after free.
    Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793
    Report Source External

    CVE CVE-2026-20569
    Subcomponent adsp
    Severity Medium
    CWE CWE-416 Use After Free
    Description There is a possible memory corruption due to use after free.
    Affected Chipsets MT6858, MT6878, MT6881, MT6897, MT6899, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678
    Report Source External

    CVE CVE-2026-20570
    Subcomponent adsp
    Severity Medium
    CWE CWE-416 Use After Free
    Description There is a possible escalation of privilege due to use after free.
    Affected Chipsets MT6858, MT6878, MT6881, MT6897, MT6899, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678
    Report Source External

    CVE CVE-2026-20571
    Subcomponent afe
    Severity Medium
    CWE CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
    Description There is a possible memory corruption due to use after free.
    Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793
    Report Source External

    CVE CVE-2026-20572
    Subcomponent adsp
    Severity Medium
    CWE CWE-191 Integer Underflow (Wrap or Wraparound)
    Description There is a possible out of bounds write due to an integer overflow.
    Affected Chipsets MT6858, MT6878, MT6881, MT6897, MT6899, MT6989, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793
    Report Source External

    CVE CVE-2026-20573
    Subcomponent afe
    Severity Medium
    CWE CWE-415 Double Free
    Description There is a possible memory corruption due to double free.
    Affected Chipsets MT2735, MT2737, MT6768, MT6781, MT6789, MT6853, MT6855, MT6877, MT6878, MT6885, MT6886, MT6890, MT6895, MT6897, MT6899, MT6980D, MT6985, MT6988, MT6989, MT6990, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793
    Report Source External

    CVE CVE-2026-20574
    Subcomponent afe
    Severity Medium
    CWE CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
    Description There is a possible memory corruption due to use after free.
    Affected Chipsets MT2735, MT2737, MT6768, MT6781, MT6789, MT6853, MT6855, MT6877, MT6878, MT6885, MT6886, MT6890, MT6895, MT6897, MT6899, MT6980D, MT6985, MT6988, MT6989, MT6990, MT6991, MT6993, MT8168, MT8186, MT8188, MT8189, MT8195, MT8196, MT8365, MT8367, MT8390, MT8391, MT8668, MT8678, MT8793
    Report Source External

    CVE CVE-2026-20575
    Subcomponent afe
    Severity Medium
    CWE CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
    Description There is a possible memory corruption due to use after free.
    Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993
    Report Source External

    CVE CVE-2026-20576
    Subcomponent afe
    Severity Medium
    CWE CWE-191 Integer Underflow (Wrap or Wraparound)
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT6789, MT6835, MT6855, MT6858, MT6877, MT6885, MT6886, MT6895, MT6897, MT6985, MT6988, MT6989, MT6991, MT6993
    Report Source External

    CVE CVE-2026-20577
    Subcomponent Modem
    Severity Medium
    CWE CWE-280 Improper Handling of Insufficient Permissions or Privileges
    Description There is a possible permission bypass due to a permissions bypass.
    Affected Chipsets MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-20578
    Subcomponent Modem
    Severity Medium
    CWE CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
    Description There is a possible information disclosure due to side channel information disclosure.
    Affected Chipsets MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-20580
    Subcomponent usb
    Severity Medium
    CWE CWE-416 Use After Free
    Description There is a possible system crash due to use after free.
    Affected Chipsets MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6889, MT6890, MT6893, MT6897, MT6985, MT6988, MT6989, MT6990, MT6991, MT6993, MT8188, MT8189, MT8196, MT8668, MT8768, MT8786
    Report Source External

    CVE CVE-2026-20581
    Subcomponent usb
    Severity Medium
    CWE CWE-416 Use After Free
    Description There is a possible memory corruption due to use after free.
    Affected Chipsets MT6858, MT6881, MT6993, MT8188, MT8189, MT8518S, MT8532, MT8668
    Report Source External

    CVE CVE-2026-20582
    Subcomponent usb
    Severity Medium
    CWE CWE-415 Double Free
    Description There is a possible memory corruption due to double free.
    Affected Chipsets MT6993, MT8188, MT8189, MT8518S, MT8532, MT8668
    Report Source External

    CVE CVE-2026-20583
    Subcomponent usb
    Severity Medium
    CWE CWE-416 Use After Free
    Description There is a possible system crash due to use after free.
    Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8188, MT8189, MT8196, MT8668, MT8768, MT8786
    Report Source External

    CVE CVE-2026-20584
    Subcomponent usb
    Severity Medium
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible memory corruption due to a missing bounds check.
    Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993
    Report Source External

    CVE CVE-2026-20585
    Subcomponent Modem
    Severity Medium
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2718, MT2737, MT6813, MT6815, MT6835, MT6858, MT6878, MT6879, MT6881, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8186, MT8188, MT8189, MT8195, MT8196, MT8367, MT8391, MT8676, MT8678
    Report Source Internal

    CVE CVE-2026-20590
    Subcomponent display
    Severity Medium
    CWE CWE-121 Stack-based Buffer Overflow
    Description There is a possible system crash due to a logic error.
    Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8188, MT8668, MT8676, MT8678, MT8793
    Report Source External

    CVE CVE-2026-20591
    Subcomponent GPU pdma
    Severity Medium
    CWE CWE-416 Use After Free
    Description There is a possible escalation of privilege due to a missing permission check.
    Affected Chipsets MT6993, MT8910
    Report Source External

    CVE CVE-2026-20592
    Subcomponent Modem
    Severity Medium
    CWE CWE-532 Insertion of Sensitive Information into Log File
    Description There is a possible information disclosure due to side channel information disclosure.
    Affected Chipsets MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-20593
    Subcomponent Modem
    Severity Medium
    CWE CWE-617 Reachable Assertion
    Description There is a possible application crash due to improper input validation.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20594
    Subcomponent Modem
    Severity Medium
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible out of bounds read due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20595
    Subcomponent neuropilot
    Severity Medium
    CWE CWE-1286 Improper Validation of Syntactic Correctness of Input
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8188, MT8189, MT8321, MT8385, MT8696, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8791T, MT8793, MT8797, MT8798, MT8875, MT8910, MT8911
    Report Source External

    CVE CVE-2026-20596
    Subcomponent Modem
    Severity Medium
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible out of bounds read due to improper input validation.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20597
    Subcomponent Modem
    Severity Medium
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible out of bounds read due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20598
    Subcomponent Modem
    Severity Medium
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible out of bounds read due to an integer overflow.
    Affected Chipsets MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-20599
    Subcomponent Modem
    Severity Medium
    CWE CWE-280 Improper Handling of Insufficient Permissions or Privileges
    Description There is a possible escalation of privilege due to a missing permission check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-20600
    Subcomponent Modem
    Severity Medium
    CWE CWE-617 Reachable Assertion
    Description There is a possible application crash due to a logic error.
    Affected Chipsets MT2716, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-68588
    Subcomponent Modem
    Severity Medium
    CWE CWE-190 Integer Overflow or Wraparound
    Description There is a possible way (for xxx) to xxxxx due to an integer overflow.
    Affected Chipsets MT2716, MT6813, MT6815, MT6835, MT6858, MT6878, MT6881, MT6897, MT6899, MT6982, MT6986, MT6988, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8875, MT8883
    Report Source Internal

    CVE CVE-2026-68589
    Subcomponent Modem
    Severity Medium
    CWE CWE-787 Out-of-bounds Write
    Description There is a possible out of bounds write due to a missing bounds check.
    Affected Chipsets MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-68590
    Subcomponent ip_stack
    Severity Medium
    CWE CWE-125 Out-of-bounds Read
    Description There is a possible out of bounds read due to improper input validation.
    Affected Chipsets MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8875, MT8883, MT8893
    Report Source Internal

    CVE CVE-2026-68591
    Subcomponent ccci
    Severity Medium
    CWE CWE-732 Incorrect Permission Assignment for Critical Resource
    Description There is a possible escalation of privilege due to a permissions bypass.
    Affected Chipsets MT2737, MT6813, MT6815, MT6835, MT6878, MT6879, MT6886, MT6895, MT6896, MT6897, MT6980, MT6983, MT6985, MT6990, MT8676, MT8755, MT8775, MT8792, MT8798, MT8863, MT8873, MT8883
    Report Source Internal

    Versions

    Version Date Description
    1.0 November 2, 2026 Bulletin published.

    Notes

    Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.

    If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.

    Notes

    Information above is generated only at the time of creation of this Security Bulletin. The list of affected chipsets could be not complete. For any further information, device OEMs can reach your MediaTek contact person if needed.
    If you want to report a security vulnerability in MediaTek chipsets or products, please go to Report Security Vulnerability page on MediaTek website.