SB2026030335 - Multiple vulnerabilities in MediaTek chipsets
Published: March 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 21 secuirty vulnerabilities.
1) Improper Validation of Specified Index, Position, or Offset in Input (CVE-ID: CVE-2026-20440)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a missing bounds check in MAE subcomponent. A local application can perform service disruption.
2) Out-of-bounds write (CVE-ID: CVE-2026-20416)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a missing bounds check . A local application can perform service disruption.
3) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-20445)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a race condition . A local application can perform service disruption.
4) Out-of-bounds read (CVE-ID: CVE-2026-20429)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing bounds check . A local application can gain access to sensitive information.
5) Out-of-bounds read (CVE-ID: CVE-2026-20424)
The vulnerability allows a local application to gain access to sensitive information.
The vulnerability exists due to a missing bounds check . A local application can gain access to sensitive information.
6) Out-of-bounds write (CVE-ID: CVE-2026-20444)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a missing bounds check . A local application can perform service disruption.
7) Use After Free (CVE-ID: CVE-2026-20443)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to use after free . A local application can perform service disruption.
8) Use After Free (CVE-ID: CVE-2026-20442)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to use after free . A local application can perform service disruption.
9) Out-of-bounds write (CVE-ID: CVE-2026-20441)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a missing bounds check . A local application can perform service disruption.
10) Use After Free (CVE-ID: CVE-2026-20439)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to use after free . A local application can perform service disruption.
11) Exposed Dangerous Method or Function (CVE-ID: CVE-2026-20423)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check . A local application can execute arbitrary code.
12) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-20438)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a race condition . A local application can perform service disruption.
13) Use After Free (CVE-ID: CVE-2026-20437)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to use after free . A local application can perform service disruption.
14) Buffer overflow (CVE-ID: CVE-2026-20436)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a missing bounds check . A local application can perform service disruption.
15) Insufficiently Protected Credentials (CVE-ID: CVE-2026-20435)
The vulnerability allows a local application to perform service disruption.
The vulnerability exists due to a logic error . A local application can perform service disruption.
16) Out-of-bounds write (CVE-ID: CVE-2026-20434)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check . A local application can execute arbitrary code.
17) Out-of-bounds write (CVE-ID: CVE-2026-20430)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to an incorrect bounds check . A local application can execute arbitrary code.
18) Out-of-bounds write (CVE-ID: CVE-2026-20428)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check . A local application can execute arbitrary code.
19) Out-of-bounds write (CVE-ID: CVE-2026-20427)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check . A local application can execute arbitrary code.
20) Out-of-bounds write (CVE-ID: CVE-2026-20426)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check . A local application can execute arbitrary code.
21) Out-of-bounds write (CVE-ID: CVE-2026-20425)
The vulnerability allows a local application to execute arbitrary code.
The vulnerability exists due to a missing bounds check . A local application can execute arbitrary code.
Remediation
Install update from vendor's website.