CVE-2026-20423

In wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00465314; Issue ID: MSV-4956.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://corp.mediatek.com/product-security-bulletin/March-2026	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:mediatek:nbiot_sdk:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:mediatek:mt7902:-:::::::*
	cpe:2.3:h:mediatek:mt7920:-:::::::*
	cpe:2.3:h:mediatek:mt7921:-:::::::*
	cpe:2.3:h:mediatek:mt7922:-:::::::*
	cpe:2.3:h:mediatek:mt7925:-:::::::*
	cpe:2.3:h:mediatek:mt7927:-:::::::*

History

No history.

Information

Published : 2026-03-02 09:16

Updated : 2026-03-03 17:16

NVD link : CVE-2026-20423

Mitre link : CVE-2026-20423

CVE.ORG link : CVE-2026-20423

JSON object : View

Products Affected

mediatek

mt7925
nbiot_sdk
mt7922
mt7921
mt7920
mt7927
mt7902

CWE

CWE-749

Exposed Dangerous Method or Function

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-20423", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2026-03-02T09:16:15.340", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/March-2026", "tags": ["Vendor Advisory"], "source": "security@mediatek.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@mediatek.com", "description": [{"lang": "en", "value": "CWE-749"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "In wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00465314; Issue ID: MSV-4956."}, {"lang": "es", "value": "En el controlador STA de WLAN, existe una posible escritura fuera de l\u00edmites debido a una falta de verificaci\u00f3n de l\u00edmites. Esto podr\u00eda llevar a una escalada local de privilegios con privilegios de ejecuci\u00f3n de usuario necesarios. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: WCNCR00465314; ID de problema: MSV-4956."}], "lastModified": "2026-03-03T17:16:18.047", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:nbiot_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "513F2D0C-0D1C-4C90-AA0F-4F43BF08EB0C", "versionEndIncluding": "3.8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt7902:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "91DEA745-47A8-43F1-A1B2-F53F651A99EF"}, {"criteria": "cpe:2.3:h:mediatek:mt7920:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "140DAC08-96E9-47D3-BC2E-65E999DCFD50"}, {"criteria": "cpe:2.3:h:mediatek:mt7921:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "32AFEA0A-FFE2-4EA9-8B51-7E3E75DE65CC"}, {"criteria": "cpe:2.3:h:mediatek:mt7922:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EA2A6813-7138-441E-A9E4-FF62FCBD797A"}, {"criteria": "cpe:2.3:h:mediatek:mt7925:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "27CFC9DF-2F4C-469A-8A19-A260B1134CFE"}, {"criteria": "cpe:2.3:h:mediatek:mt7927:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "05525018-AFE0-415C-A71C-A77922C7D637"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@mediatek.com"}