SB2026010554 - Multiple vulnerabilities in MediaTek chipsets

Main Vulnerability Database SB2026010554

SB2026010554 - Multiple vulnerabilities in MediaTek chipsets

Published: January 5, 2026

Security Bulletin ID SB2026010554

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 28

Exploitation vector Local access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 28 vulnerabilities.

1) Out-of-bounds write (CVE-ID: CVE-2025-20795)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within KeyInstall. A local application can execute arbitrary code.

2) Stack-based buffer overflow (CVE-ID: CVE-2025-20794)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation within Modem. A local application can execute arbitrary code.

3) NULL Pointer Dereference (CVE-ID: CVE-2025-20793)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to incorrect error handling within Modem. A local application can execute arbitrary code.

4) Reachable Assertion (CVE-ID: CVE-2025-20762)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to incorrect error handling within Modem. A local application can execute arbitrary code.

5) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2025-20761)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to incorrect error handling within Modem. A local application can execute arbitrary code.

6) Reachable Assertion (CVE-ID: CVE-2025-20760)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to an uncaught exception within Modem. A local application can execute arbitrary code.

7) Improper Validation of Specified Index, Position, or Offset in Input (CVE-ID: CVE-2025-20796)

CWE-ID: CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to improper input validation within imgsys. A local application can perform service disruption.

8) Stack-based buffer overflow (CVE-ID: CVE-2025-20797)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a missing bounds check within battery. A local application can perform service disruption.

9) Out-of-bounds write (CVE-ID: CVE-2025-20798)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a missing bounds check within battery. A local application can perform service disruption.

10) Use After Free (CVE-ID: CVE-2025-20799)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within c2ps. A local application can perform service disruption.

11) Out-of-bounds write (CVE-ID: CVE-2025-20800)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a missing bounds check within mminfra. A local application can perform service disruption.

12) Double Free (CVE-ID: CVE-2025-20801)

CWE-ID: CWE-415 - Double Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a race condition within seninf. A local application can perform service disruption.

13) Use After Free (CVE-ID: CVE-2025-20802)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within geniezone. A local application can perform service disruption.

14) Out-of-bounds write (CVE-ID: CVE-2025-20778)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a missing bounds check within display. A local application can perform service disruption.

15) Use After Free (CVE-ID: CVE-2025-20780)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within display. A local application can perform service disruption.

16) Use After Free (CVE-ID: CVE-2025-20779)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a race condition within display. A local application can perform service disruption.

17) Double Free (CVE-ID: CVE-2025-20781)

CWE-ID: CWE-415 - Double Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within display. A local application can perform service disruption.

18) Out-of-bounds write (CVE-ID: CVE-2025-20782)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a missing bounds check within display. A local application can perform service disruption.

19) Out-of-bounds write (CVE-ID: CVE-2025-20783)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to a missing bounds check within display. A local application can perform service disruption.

20) Use of Uninitialized Variable (CVE-ID: CVE-2025-20784)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to uninitialized data within display. A local application can perform service disruption.

21) Use After Free (CVE-ID: CVE-2025-20785)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within display. A local application can perform service disruption.

22) Double Free (CVE-ID: CVE-2025-20786)

CWE-ID: CWE-415 - Double Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within display. A local application can perform service disruption.

23) Use After Free (CVE-ID: CVE-2025-20787)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within display. A local application can perform service disruption.

24) Integer overflow (CVE-ID: CVE-2025-20803)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to an integer overflow within dpe. A local application can perform service disruption.

25) Use After Free (CVE-ID: CVE-2025-20804)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within dpe. A local application can perform service disruption.

26) Use After Free (CVE-ID: CVE-2025-20805)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within dpe. A local application can perform service disruption.

27) Use After Free (CVE-ID: CVE-2025-20806)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to use after free within dpe. A local application can perform service disruption.

28) Integer overflow (CVE-ID: CVE-2025-20807)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local application to perform service disruption.

The vulnerability exists due to an integer overflow within dpe. A local application can perform service disruption.

Remediation

Install update from vendor's website.

References

https://corp.mediatek.com/product-security-bulletin/January-2026