MediaTek July 2026 Security Bulletin: Multiple High-Severity Modem Vulnerabilities (CVE-2026-20457/20458/20459)

Vulnerability Overview MediaTek issued its July 2026 Product Security Announcement, detailing multiple security vulnerabilities affecting specific MediaTek chipsets. These vulnerabilities are classified as either “High” or “Medium” severity and are accompanied by corresponding CVE identifiers. Impact Scope High Severity Vulnerabilities 1. CVE-2026-20457 - Subcomponent: Modem - CWE: CWE-476 NULL Pointer Dereference - Description: Incorrect input validation may lead to system crashes. - Affected Chipsets: MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6895, MT6890, MT6893, MT6895, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6993, MT8666, MT8667, MT8673, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8775, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791, MT8791T, MT8795T, MT8796, MT8797, MT8798, MT8893 2. CVE-2026-20458 - Subcomponent: Modem - CWE: CWE-787 Out-of-bounds Write - Description: Missing boundary checks may lead to memory corruption. - Affected Chipsets: MT2716, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6855, MT6878, MT6879, MT6881, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6993, MT8666, MT8667, MT8673, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8775, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8792, MT8793, MT8795T, MT8796, MT8798, MT8863, MT8873, MT8883, MT8893 3. CVE-2026-20459 - Subcomponent: Modem - CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel - Description: Incorrect input validation may lead to system crashes. - Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6833, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT6993, MT8666, MT8667, MT8668, MT8673, MT8675, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893 4. CVE-2026-20460 - Subcomponent: Modem - CWE: CWE-288 Authentication Bypass Using an Alternate Path or Channel - Description: Incorrect input validation may lead to information leakage. - Affected Chipsets: MT2735, MT2737, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6983, MT6985, MT6986D, MT6988, MT6989, MT6990, MT6991, MT6993, MT8673, MT8675, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893 5. CVE-2026-20461 - Subcomponent: Modem - CWE: CWE-787 Out-of-bounds Write - Description: Missing boundary checks may lead to out-of-bounds writes. - Affected Chipsets: MT2737, MT6813, MT6835, MT6858, MT6878, MT6879, MT6886, MT6895, MT6896, MT6897, MT6899, MT6980, MT6983, MT6985, MT6986, MT6989, MT6990, MT6991, MT6993, MT8673, MT8676, MT8678, MT8755, MT8775, MT8792, MT8793, MT8795T, MT8796, MT8798, MT8863, MT8873, MT8883, MT8893 Medium Severity Vulnerabilities 1. CVE-2026-20462 - Subcomponent: Telephony - CWE: CWE-122 Heap Overflow - Description: Heap buffer overflow may lead to memory corruption. - Affected Chipsets: MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6853, MT6855, MT6877, MT6883, MT6885, MT6889, MT6893, MT6895, MT6896, MT6765, MT6766, MT6766R, MT6768, MT6781, MT6791 2. CVE-2026-20463 - Subcomponent: Modem - CWE: CWE-280 Improper Handling of Insufficient Permissions or Privileges - Description: Permission bypass may lead to privilege escalation. - Affected Chipsets: MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988, MT6989, MT6990, MT6991, MT6993, MT8666, MT8667, MT8668, MT8673, MT8675, MT8676, MT8678, MT8755, MT8765, MT8766, MT8766R, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8788E, MT8789, MT8791, MT8791T, MT8792, MT8793, MT8795T, MT8796, MT8797, MT8798, MT8863, MT8873, MT8883, MT8893 Remediation MediaTek has notified all device OEMs regarding these

Goal Reached Thanks to every supporter — we hit 100%!

MediaTek July 2026 Security Bulletin: Multiple High-Severity Modem Vulnerabilities (CVE-2026-20457/20458/20459)