MediaTek Modem/SecBoot Vulnerability Advisory: CVE-2026-20431/20432/20433/20446

Vulnerability Overview This advisory covers 4 security vulnerabilities, of which 3 are classified as High severity and 1 as Medium severity. High Severity Vulnerabilities: CVE-2026-20431, CVE-2026-20432, CVE-2026-20433 Medium Severity Vulnerability: CVE-2026-20446 Scope and Details 1. CVE-2026-20431 Component: Modem Severity: High Type: CWE-770 Allocation of Resources Without Limits or Throttling Description: A logic error may lead to system crashes. Affected Chipsets: MT6813, MT6815, MT6835, MT6878, MT6897, MT6899, MT6986, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8863, MT8873, MT8883 2. CVE-2026-20432 Component: Modem Severity: High Type: CWE-787 Out-of-bounds Write Description: Missing boundary checks may lead to out-of-bounds writes. Affected Chipsets: MT2735, MT2737, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6815, MT6835, MT6855, MT6873, MT6875, MT6877, MT6877T, MT6878, MT6890, MT6893, MT6895, MT6899, MT6980, MT6983, MT6985, MT6989, MT6990, MT6991, MT6993, MT6995, MT8755, MT8775, MT8791, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893 3. CVE-2026-20433 Component: Modem Severity: High Type: CWE-787 Out-of-bounds Write Description: Missing boundary checks may lead to out-of-bounds writes. Affected Chipsets: MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, MT6835T, MT6853, MT6853T, MT6855, MT6855T, MT6873, MT6875, MT6875T, MT6877, MT6877T, MT6878, MT6878M, MT6879, MT6880, MT6883, MT6885, MT6890, MT6893, MT6895, MT6899, MT6980, MT6981, MT6983, MT6985, MT6989T, MT6990, MT6991, MT6993, MT6995, MT8755, MT8771, MT8775, MT8791, MT8792, MT8793, MT8795T, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893 4. CVE-2026-20446 Component: sec boot (Secure Boot) Severity: Medium Type: CWE-787 Out-of-bounds Write Description: An integer overflow may lead to out-of-bounds writes. Affected Chipsets: MT6813 Remediation MediaTek has notified all relevant device OEMs and provided corresponding security patches at least two months prior to the release. Advisory Version: 1.0 (Release Date: April 7, 2026) Note: The page does not provide specific patch version numbers; affected manufacturers are advised to refer to official patches.

Goal Reached Thanks to every supporter — we hit 100%!

MediaTek Modem/SecBoot Vulnerability Advisory: CVE-2026-20431/20432/20433/20446