SB2026040719 - Multiple vulnerabilities in MediaTek chipsets (April 2026)
Published: April 7, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-20431)
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in modem when handling input. A local user can trigger the logic error to cause a denial of service.
2) Out-of-bounds write (CVE-ID: CVE-2026-20432)
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to out-of-bounds write in modem when handling input. A local user can send crafted input to cause memory corruption.
3) Out-of-bounds write (CVE-ID: CVE-2026-20433)
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to out-of-bounds write in modem when handling input. A local user can send crafted input to cause memory corruption.
4) Integer overflow (CVE-ID: CVE-2026-20446)
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to integer overflow in sec boot when handling input. A local user can send crafted input to cause memory corruption.
Remediation
Install update from vendor's website.