Mediatek vulnerabilities
Published CVEs affecting Mediatek products: 245 record(s), with severity, exploitation and fixes.
MediaTek chipset 174Mt6991 Firmware 45Mt6993 Firmware 44Mt8668 Firmware 44Mt8793 Firmware 41Mt8781 Firmware 41Mt8678 Firmware 40Mt6899 Firmware 37Mt8676 Firmware 37Mt8792 Firmware 37Mt6989 Firmware 35Mt6877 Firmware 34Mt8910 Firmware 34Mt6878 Firmware 33Mt8791t Firmware 33Mt6855 Firmware 32Software Development Kit 31Nr15 30Mt6897 Firmware 30Mt6833 Firmware 28Mt6835 Firmware 28Mt6853 Firmware 28Mt6893 Firmware 28Mt6883 Firmware 27Mt6885 Firmware 27Mt6889 Firmware 27Mt6895 Firmware 26Mt6983 Firmware 26Mt6985 Firmware 26Mt8775 Firmware 26Mt8188 Firmware 26Mt6879 Firmware 25Mt6886 Firmware 25Mt6890 Firmware 25Mt6768 Firmware 25Mt6789 Firmware 25Mt6988 Firmware 24Mt8189 Firmware 24Mt8768 Firmware 24Mt6881 Firmware 23
CVE-2025-20791
Medium · 6.5
CWE-617 Dec 2, 2025
In Modem, there is a possible system crash due to incorrect error handling. This could…
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01661189; Issue ID: MSV-4298.
CVE-2025-20790
Medium · 5.3
CWE-476 Dec 2, 2025
NULL Pointer Dereference in Mediatek Nr15
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01677581; Issue ID: MSV-4701.
CVE-2025-20789
Medium · 4.4
CWE-201 Dec 2, 2025
Insertion of Sensitive Information Into Sent Data in Google Android
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538.
CVE-2025-20788
Medium · 4.4
CWE-1262 Dec 2, 2025
In GPU pdma, there is a possible memory corruption due to a missing permission check…
In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117735; Issue ID: MSV-4539.
CVE-2025-20777
Medium · 6.7
CWE-787 Dec 2, 2025
Out-of-bounds Write in Google Android
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4752.
CVE-2025-20776
Medium · 6.7
CWE-125 Dec 2, 2025
Out-of-bounds Read in Google Android
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184297; Issue ID: MSV-4759.
CVE-2025-20775
Medium · 6.7
CWE-416 Dec 2, 2025
Use After Free in Google Android
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
CVE-2025-20774
Medium · 6.7
CWE-787 Dec 2, 2025
Out-of-bounds Write in Google Android
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4796.
CVE-2025-20773
Medium · 6.7
CWE-416 Dec 2, 2025
Use After Free in Google Android
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4797.
CVE-2025-20772
Medium · 6.7
CWE-416 Dec 2, 2025
Use After Free in Google Android
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10182914; Issue ID: MSV-4795.
CVE-2025-20771
Medium · 6.7
CWE-457 Dec 2, 2025
Use of Uninitialized Variable in Google Android
In display, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4802.
CVE-2025-20770
Medium · 6.7
CWE-416 Dec 2, 2025
Use After Free in Google Android
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4803.
CVE-2025-20769
Medium · 6.7
CWE-787 Dec 2, 2025
Out-of-bounds Write in Google Android
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4804.
CVE-2025-20768
High · 7.8
CWE-125 Dec 2, 2025
Out-of-bounds Read in Google Android
In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.
CVE-2025-20767
High · 7.8
CWE-787 Dec 2, 2025
Out-of-bounds Write in Google Android
In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4807.
CVE-2025-20766
High · 7.8
CWE-457 Dec 2, 2025
Use of Uninitialized Variable in Google Android
In display, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4820.
CVE-2025-20765
Medium · 4.7
CWE-362 Dec 2, 2025
Race Condition in Linuxfoundation Yocto
In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.
CVE-2025-20764
High · 7.8
CWE-787 Dec 2, 2025
Out-of-bounds Write in Google Android
In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10259774; Issue ID: MSV-5029.
CVE-2025-20763
High · 7.8
CWE-787 Dec 2, 2025
Out-of-bounds Write in Google Android
In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267218; Issue ID: MSV-5032.
CVE-2025-20759
Medium · 6.5
CWE-125 Dec 2, 2025
Out-of-bounds Read in Mediatek Nr15
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673760; Issue ID: MSV-4650.
CVE-2025-20758
Medium · 4.9
CWE-248 Dec 2, 2025
In Modem, there is a possible system crash due to an uncaught exception. This could lead…
In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673755; Issue ID: MSV-4647.
CVE-2025-20757
Medium · 6.5
CWE-617 Dec 2, 2025
In Modem, there is a possible system crash due to improper input validation. This could…
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673751; Issue ID: MSV-4644.
CVE-2025-20756
Medium · 6.5
CWE-1287 Dec 2, 2025
In Modem, there is a possible system crash due to a logic error. This could lead to…
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01673749; Issue ID: MSV-4643.
CVE-2025-20755
Medium · 5.3
CWE-476 Dec 2, 2025
NULL Pointer Dereference in Mediatek Nr15
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00628396; Issue ID: MSV-4775.
CVE-2025-20754
Medium · 5.3
CWE-248 Dec 2, 2025
In Modem, there is a possible system crash due to an incorrect bounds check. This could…
In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01689251; Issue ID: MSV-4840.