MediaTek vulnerabilities
We track 224 vulnerabilities in MediaTek products across 60+ products. 224 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest MediaTek vulnerabilities
- 7.8 High severity
MT6580, MT6739, MT6761, MT6762, MT6765…: Out-of-bounds Write
In decoder, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08016659; Issue ID: ALPS
- 7.8 High severity
MT2713, MT6580, MT6739, MT6761, MT6762…: Out-of-bounds Write
In audio, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08241940; Issue ID: ALP
- 7.5 High severity
MT2735, MT2737, MT6297, MT6298, MT6813…: Reachable Assertion
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Pa
- 7.5 High severity
MT2735, MT2737, MT6297, MT6298, MT6813…: Reachable Assertion
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Pa
- 7.5 High severity
MT2735, MT2737, MT6297, MT6298, MT6813…: Reachable Assertion
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Pa
- 7.5 High severity
MT2735, MT2737, MT6297, MT6298, MT6813…: Reachable Assertion
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Pa
- 7.5 High severity
MT2735, MT2737, MT6297, MT6298, MT6813…: Reachable Assertion
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Pa
- 7.5 High severity
MT2735, MT2737, MT6297, MT6298, MT6813…: Reachable Assertion
In 5G Modem, there is a possible system crash due to improper error handling. This could lead to remote denial of service when receiving malformed RRC messages, with no additional execution privileges needed. User interaction is not needed for exploitation. Pa
- 7.8 High severity
MT6883, MT6885, MT6889, MT6893, MT8797, MT8798: Out-of-bounds Write
In video, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID:
- 7.0 High severity
MT6883, MT6885, MT6889, MT6893, MT6895…: Out-of-bounds Write
In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08235273; Issue ID: ALPS082
- 7.5 High severity
MT5221, MT6781, MT6833, MT6853, MT6853T…: Reachable Assertion
In wlan firmware, there is a possible firmware assertion due to improper input handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07932637; Issue
- 9.8 Critical severity
MT2731, MT6570, MT6580, MT6595, MT6732…: Out-of-bounds Write
In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID: MOLY0106823
- 7.8 High severity
MT6580, MT6735, MT6737, MT6739, MT6753…: Missing Authorization
In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07611449; Iss
- 7.5 High severity
MT6739, MT6895, MT6983, MT8167, MT8168…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664711; Issue ID: ALPS07
- 7.5 High severity
MT6739, MT8167, MT8168, MT8321, MT8365…: Improper Handling of Exceptional Conditions
In wlan firmware, there is possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664720; Issue ID: ALPS07
- 7.5 High severity
MT6739, MT8167, MT8321, MT8365, MT8385…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664731; Issue ID: ALPS0766
- 7.5 High severity
MT6739, MT8167, MT8168, MT8321, MT8365…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664735; Issue ID: ALPS0766
- 7.5 High severity
MT6739, MT8167, MT8321, MT8365, MT8385…: Integer Overflow or Wraparound
In wlan firmware, there is possible system crash due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07664741; Issue ID: ALPS0766
- 7.8 High severity
MT2715, MT6580, MT6735, MT6737, MT6739…: Improper Privilege Management
In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07203022; Issue ID: AL
- 7.5 High severity
MT5221, MT7603, MT7613, MT7615, MT7622…: NULL Pointer Dereference
In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN20220720014; Issue ID: G
- 9.8 Critical severity
EN7528, EN7580: Improper Neutralization of Special Elements used in a Command
In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20220026; Issue ID: OS
- 8.8 High severity
EN7516, EN7528, EN7529, EN7561, EN7562, EN7580: Improper Neutralization of Special Elements used in a Command
In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Patch ID: A20220004; Issue ID: OSBN
- 7.8 High severity
MT6580, MT6735, MT6739, MT6753, MT6757…: Out-of-bounds Write
In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07573237; Issue ID: A
- 7.8 High severity
MT6739, MT6761, MT6762, MT6763, MT6765…: Deserialization of Untrusted Data
In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319132; Issue
- 7.5 High severity
MT2731, MT2735, MT6297, MT6725, MT6739…: Reachable Assertion
In Modem 4G RRC, there is a possible system crash due to improper input validation. This could lead to remote denial of service, when concatenating improper SIB12 (CMAS message), with no additional execution privileges needed. User interaction is not needed fo
- 7.5 High severity
In ril, there is a possible system crash due to an incorrect bounds check.
In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07257259; Issue ID: ALPS072572
- 7.5 High severity
MT6761, MT6762, MT6765, MT6768, MT6779…: Improper Resource Shutdown or Release
In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0703060
- 7.8 High severity
MT6739, MT6761, MT6762, MT6763, MT6765…: Deserialization of Untrusted Data
In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319095; Issue
- 7.8 High severity
MT6580, MT6739, MT6761, MT6765, MT6768…: Deserialization of Untrusted Data
In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319121;
- 7.8 High severity
MT6580, MT6735, MT6737, MT6739, MT6761…: Use of Externally-Controlled Input to Select Classes or Code
In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07216598; Issue
- 9.8 Critical severity
MT6580, MT6735, MT6737, MT6739, MT6750S…: Out-of-bounds Write
In BT firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784478; Issue ID: A
- 9.8 Critical severity
MT2621, MT2625: Use of Uninitialized Resource
In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WSAP00103831; Issue I
- 7.8 High severity
MT6580, MT6735, MT6739, MT6757, MT6761…: Missing Authorization
In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Pat
- 7.8 High severity
MT6580, MT6735, MT6739, MT6761, MT6765…: Missing Authorization
In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06713894; Issu
- 8.8 High severity
MT8167S, MT8175, MT8183, MT8362A, MT8365, MT8385: Out-of-bounds Write
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784351; Issue
- 8.8 High severity
MT8167, MT8175, MT8183, MT8362A, MT8365, MT8385: Out-of-bounds Write
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784430; Issue
- 9.8 Critical severity
MT2731, MT2735, MT6297, MT6725, MT6735…: Out-of-bounds Write
In Modem 2G RR, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding GPRS Packet Neighbour Cell Data (PNCD) improper neighbouring cell size with no additional execution privileges needed.
- 9.8 Critical severity
MT2731, MT2735, MT6297, MT6725, MT6735…: Out-of-bounds Write
In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding combined FACILITY with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.0 High severity
MT6768, MT6769, MT6781, MT6785, MT6789…: Concurrent Execution using Shared Resource with Improper Synchronization
In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07044730; Issue ID: ALPS07044730
- 7.5 High severity
MT6833, MT6853, MT6877, MT6885, MT6889…: Improper Validation of Integrity Check Value
In WIFI Firmware, there is a possible system crash due to a missing count check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06468894; Issue ID: ALPS