CVE-2026-20446

In sec boot, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service, if an attacker has physical access to the device, with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09963054; Issue ID: MSV-3899.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/April-2026	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*

History

07 Apr 2026, 15:43

Type	Values Removed	Values Added
First Time		Mediatek mt6813 Firmware Mediatek mt6813 Mediatek
CPE		cpe:2.3:o:mediatek:mt6813_firmware:-:::::::* cpe:2.3:h:mediatek:mt6813:-:::::::*
References	~~() https://corp.mediatek.com/product-security-bulletin/April-2026 -~~	() https://corp.mediatek.com/product-security-bulletin/April-2026 - Vendor Advisory

07 Apr 2026, 14:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CWE		CWE-190

07 Apr 2026, 04:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-07 04:17

Updated : 2026-04-07 15:43

NVD link : CVE-2026-20446

Mitre link : CVE-2026-20446

CVE.ORG link : CVE-2026-20446

JSON object : View

Products Affected

mediatek

mt6813_firmware
mt6813

CWE

CWE-787

Out-of-bounds Write

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-20446", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.7}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.7}]}, "published": "2026-04-07T04:17:13.797", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/April-2026", "tags": ["Vendor Advisory"], "source": "security@mediatek.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@mediatek.com", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "In sec boot, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service, if an attacker has physical access to the device, with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09963054; Issue ID: MSV-3899."}], "lastModified": "2026-04-07T15:43:45.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mediatek:mt6813_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E1CB25C-4643-4239-AE47-B5AE876416ED"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6813:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "66F9EAE4-F1D7-46DB-AA2A-0290F6EF0501"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mediatek.com"}