CVE-2026-20493

Local Denial of Service via Out-of-Bounds Write in MediaTek WiFi Driver

Published Aug 3, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575.

Analysis

Technical impact

The vulnerability is an out‑of‑bounds write in the MediaTek WiFi driver caused by a missing bounds check, which can lead to local denial of service when an attacker already has system privilege. No user interaction is required for exploitation.

Affected Systems

This issue affects MediaTek chipset products, specifically the WiFi driver on devices powered by MediaTek processors. The precise product list is not detailed in the advisory, but any device using the affected chipset firmware is potentially vulnerable. No specific version numbers are provided, so all current releases carrying the unpatched driver should be considered at risk until a patch is applied.

Risk and Exploitability

The exploit requires that the attacker already possess system privileges; no user interaction is needed and it cannot be triggered remotely. EPSS score is < 1%. The CVSS score is 4.4. The vulnerability is not listed in CISA KEV, indicating no confirmed public exploits yet. While the flaw denies WiFi functionality to the affected device, it does not allow modification of other system resources without additional privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MediaTek, Inc.

MediaTek chipset

unaffected

Version	Status	Constraints
`MT6890`	affected	—
`MT6988`	affected	—
`MT6990`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:mediatek:mt6890_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6890:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:mediatek:mt6988_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6988:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:mediatek:mt6990_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6990:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Mediatek, Inc.

Mediatek Chipset

Version	Status	Scheme	Platform
`MT6890`	affected	generic	—
`MT6988`	affected	generic	—
`MT6990`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the device firmware or WiFi driver to a version that includes the BORA00154903 patch from MediaTek
Confirm with MediaTek support that the patch applies to all chipset variants in use
Perform a staged rollout of the patch to all affected devices before full deployment

Generated by OpenCVE AI on August 4, 2026 at 10:47 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.143% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.mediatek.com/product-security-bulletin/August-2026

History

Aug 19, 2026 3:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mediatek Mediatek mt6890 Mediatek mt6890 Firmware Mediatek mt6988 Mediatek mt6988 Firmware Mediatek mt6990 Mediatek mt6990 Firmware
CPEs		cpe:2.3:h:mediatek:mt6890:-:::::::* cpe:2.3:h:mediatek:mt6988:-:::::::* cpe:2.3:h:mediatek:mt6990:-:::::::* cpe:2.3:o:mediatek:mt6890_firmware:-:::::::* cpe:2.3:o:mediatek:mt6988_firmware:-:::::::* cpe:2.3:o:mediatek:mt6990_firmware:-:::::::*
Vendors & Products		Mediatek Mediatek mt6890 Mediatek mt6890 Firmware Mediatek mt6988 Mediatek mt6988 Firmware Mediatek mt6990 Mediatek mt6990 Firmware

Aug 4, 2026 11:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Denial of Service via Out-of-Bounds Write in MediaTek WiFi Driver

Aug 3, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 3, 2026 6:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mediatek, Inc. Mediatek, Inc. mediatek Chipset
Vendors & Products		Mediatek, Inc. Mediatek, Inc. mediatek Chipset

Aug 3, 2026 2:45 AM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575.
Weaknesses		CWE-787
References		https://www.mediatek.com/product-security-bulletin/August-2026