#VU86139 Out-of-bounds write in MediaTek products - CVE-2024-20001
Published: February 6, 2024
Vulnerability identifier: #VU86139
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-20001
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
MT5583
MT5586
MT5691
MT5695
MT5696
MT9010
MT9011
MT9012
MT9015
MT9016
MT9020
MT9021
MT9022
MT9025
MT9026
MT9216
MT9218
MT9220
MT9221
MT9222
MT9255
MT9256
MT9266
MT9269
MT9286
MT9288
MT9602
MT9603
MT9610
MT9611
MT9612
MT9613
MT9615
MT9617
MT9618
MT9629
MT9630
MT9631
MT9632
MT9633
MT9636
MT9638
MT9639
MT9649
MT9650
MT9652
MT9653
MT9660
MT9666
MT9667
MT9669
MT9671
MT9675
MT9679
MT9685
MT9686
MT9688
MT9689
MT5583
MT5586
MT5691
MT5695
MT5696
MT9010
MT9011
MT9012
MT9015
MT9016
MT9020
MT9021
MT9022
MT9025
MT9026
MT9216
MT9218
MT9220
MT9221
MT9222
MT9255
MT9256
MT9266
MT9269
MT9286
MT9288
MT9602
MT9603
MT9610
MT9611
MT9612
MT9613
MT9615
MT9617
MT9618
MT9629
MT9630
MT9631
MT9632
MT9633
MT9636
MT9638
MT9639
MT9649
MT9650
MT9652
MT9653
MT9660
MT9666
MT9667
MT9669
MT9671
MT9675
MT9679
MT9685
MT9686
MT9688
MT9689
Software vendor:
MediaTek
MediaTek
Description
The vulnerability allows a local privileged application to execute arbitrary code.
The vulnerability exists due to a missing bounds check within TVAPI. A local privileged application can execute arbitrary code.
Remediation
Install security update from vendor's website.