#VU77897 Buffer overflow in MediaTek products - CVE-2023-20775

Vulnerability identifier: #VU77897

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2023-20775

CWE-ID: CWE-120

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
MT6739
MT6757
MT6757C
MT6757CD
MT6757CH
MT6761
MT6763
MT6765
MT6768
MT6771
MT6789
MT6833
MT6835
MT6855
MT6879
MT6886
MT6890
MT6895
MT6983
MT6985
MT6990
MT8168
MT8183
MT8195
MT8673
MT8781
MT6779
MT6781
MT6785
MT6853
MT6853T
MT6873
MT6877
MT6885
MT6889
MT6893

Software vendor:
MediaTek

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to a missing bounds check within display. A local privileged application can execute arbitrary code.

Install security update from vendor's website.

• https://corp.mediatek.com/product-security-bulletin/July-2023