high · CVSS v3 7.5

CVE-2026-20552

CVE-2026-20552 is an out-of-bounds write vulnerability in the ccci component of MediaTek firmware. It can cause a remote denial-of-service w

Overview

CVE-2026-20552 is an out-of-bounds write vulnerability in the ccci component of MediaTek firmware. It can cause a remote denial-of-service when a user interacts with the affected device. The flaw requires no elevated privileges and is mitigated by applying the vendor patch.

Description

In ccci, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11523478 (Note: For MT6880, MT6890) / ALPS11297423 (Note: For MT6813, MT6986, MT6982, MT6980D) / AUTO00864897 (Note: For MT2735, MT2737); Issue ID: MSV-10724.

Impact

The vulnerability can lead to a denial of service, disrupting availability for end-users and operators of affected MediaTek devices. Confidentiality and integrity are not directly compromised, but the service interruption can affect business operations and user experience.

Remediation

Apply the official firmware patch ALPS11523478 for MT6880/MT6890, ALPS11297423 for MT6813/MT6986/MT6982/MT6980D, or AUTO00864897 for MT2735/MT2737. If a patch is not yet available, disable or restrict ccci interfaces and monitor for anomalous write attempts.

Risk context

High severity (CVSS 7.5) indicates a significant risk of service disruption. While no EPSS data is available, the lack of privilege escalation means the threat is moderate to high for exposed devices. Defenders should prioritize patching.

Affected products

  • MediaTek MT6880
  • MediaTek MT6890
  • MediaTek MT6813
  • MediaTek MT6986
  • MediaTek MT6982
  • MediaTek MT6980D
  • MediaTek MT2735
  • MediaTek MT2737

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

denial-of-service out-of-bounds MediaTek CCCI remote patch firmware

← All CVEs

Related CVEs

high

CVE-2026-20555

CVE-2026-20555 is an out‑of‑bounds read in modem firmware that can cause a remote denial of service when a user equipment (UE) connects to a rogue base station. The flaw requires no user interaction or elevated privileges and can be triggered by an attacker controlling the base station. Affected devices can become unresponsive, disrupting connectivity for users.

View analysis

high

CVE-2026-20558

CVE-2026-20558 is a local privilege escalation vulnerability in the GPU pdma component caused by a use‑after‑free bug. It allows an attacker with local access to gain higher privileges on the affected system without additional execution privileges. The flaw exists in the Windows GPU driver and requires no user interaction.

View analysis

high

CVE-2026-20559

CVE-2026-20559 is a use‑after‑free memory corruption in GPU pdma that can lead to local privilege escalation. The flaw exists in the GPU driver and does not require user interaction. It allows an attacker with user execution privileges to gain higher privileges on the host.

View analysis

high

CVE-2026-20560

CVE-2026-20560 causes a modem crash due to improper input validation when a UE connects to a rogue base station. The flaw can trigger a remote denial‑of‑service without user interaction or elevated privileges. It affects devices that rely on the vulnerable modem firmware.

View analysis