MediaTek October 2026 Security Bulletin Fixes 31 Vulnerabilities

MediaTek discloses 31 chipset vulnerabilities

MediaTek has published its October 2026 Product Security Bulletin, detailing 31 security vulnerabilities affecting certain MediaTek chipsets.

The bulletin includes:

• 2 Critical vulnerabilities

• 9 High-severity vulnerabilities

• 20 Medium-severity vulnerabilities

MediaTek says the severity ratings were determined using CVSS v3.1. The company also states that device OEMs were notified of all the issues and corresponding security patches at least two months before the bulletin was published.

MediaTek further says that, at the time of publication, it was not aware of any active exploitation of these vulnerabilities in the wild.

The vulnerabilities affect multiple chipset components, including modems, video processing, APU-related components, security-related components, display, battery, CCCI and AIDL.

Two critical vulnerabilities affect MediaTek modems

The two critical issues are CVE-2026-20519 and CVE-2026-20520.

Both affect the Modem subcomponent and are classified as CWE-787, Out-of-bounds Write.

MediaTek describes both vulnerabilities as possible out-of-bounds writes caused by missing bounds checks. The company lists the report source for both vulnerabilities as Internal.

The two critical vulnerabilities affect a broad set of MediaTek chipsets, including models across the MT27xx, MT68xx, MT69xx, MT8xxx and MT88xx families.

MediaTek's bulletin provides the complete affected-chipset list for each CVE. The company also cautions that the affected-chipset list may not be complete.

Critical vulnerabilities

Nine high-severity vulnerabilities span multiple components

The bulletin lists nine High-severity vulnerabilities.

Two affect video processing components, while others involve the Video HAL, neuropilot, APU and modem.

The issues include out-of-bounds writes, stack-based buffer overflow, improper input validation, reachable assertions and improper array-index validation.

High-severity vulnerabilities

The two neuropilot vulnerabilities, CVE-2026-20522 and CVE-2026-20523, are both classified as out-of-bounds write issues.

CVE-2026-20524 affects the APU and involves improper validation of a specified index, position or offset in input.

CVE-2026-20525 affects the modem and could result in a possible system crash according to MediaTek's description.

CVE-2026-20521 affects the Video HAL and is described as a possible privilege escalation caused by a missing bounds check.

Twenty medium-severity vulnerabilities add to the patch workload

The bulletin also contains 20 Medium-severity vulnerabilities across several chipset components.

These include:

• vdec

• mtee

• meta

• ccci

• battery

• display

• apu

• aidl

• Modem

• apusys

The vulnerabilities cover several classes of security and reliability issues, including out-of-bounds reads and writes, use-after-free, double-free, type confusion, integer overflow, missing authorization, buffer over-read and information disclosure.

Medium-severity vulnerability breakdown

These descriptions reflect MediaTek's wording in the bulletin and do not establish that the vulnerabilities have been exploited or that specific attacks are possible beyond what the company disclosed.

Modem vulnerabilities feature prominently in the bulletin

The Modem component appears repeatedly across the October bulletin.

The two Critical vulnerabilities, CVE-2026-20519 and CVE-2026-20520, both affect the modem.

Several High-severity vulnerabilities also affect the modem, including CVE-2026-20525, CVE-2026-20526 and CVE-2026-20527.

The Medium-severity section includes additional modem issues, including CVE-2026-20534, CVE-2026-20538, CVE-2026-20539, CVE-2026-20540, CVE-2026-20541 and CVE-2026-20543.

The bulletin therefore shows that modem-related components account for a substantial portion of the disclosed issues, although MediaTek does not provide an overall risk ranking by component.

Memory safety issues appear throughout the bulletin

Several of the vulnerabilities involve memory-safety problems.

The bulletin includes multiple examples of:

• Out-of-bounds writes

• Out-of-bounds reads

• Use-after-free

• Double-free

• Buffer over-read

• Stack-based buffer overflow

• Integer overflow

• Type confusion

The two Critical modem vulnerabilities are both out-of-bounds write issues.

The High-severity vulnerabilities also include several out-of-bounds write conditions, while the Medium category contains additional memory corruption and memory-access issues.

Affected chipsets span multiple MediaTek product families

The bulletin lists affected chipsets across a wide range of MediaTek platforms.

Examples include:

• MT2716

• MT2718

• MT2735

• MT2737

• MT6768

• MT6789

• MT6833

• MT6855

• MT6878

• MT6899

• MT6993

• MT8188

• MT8196

• MT8668

• MT8781

• MT8793

• MT8910

These are examples rather than a complete affected-device list.

MediaTek explicitly notes that the affected-chipset list in the bulletin could not be complete and advises device OEMs to contact their MediaTek contact person for further information.

This distinction matters because chipset-level vulnerability disclosure does not by itself identify every consumer or enterprise device that may be affected.

Device manufacturers determine which MediaTek chipsets are present in their products and how corresponding security patches are distributed.

What MediaTek says about exploitation

MediaTek states that it is not aware of any active exploitation of these vulnerabilities in the wild at the time of publication.

That statement should not be interpreted as confirmation that every affected device has already received a security update.

The bulletin explains that OEMs were notified of the issues and corresponding patches at least two months before publication.

MediaTek's bulletin is therefore primarily a disclosure and patch-information document. It does not identify a known active campaign exploiting the vulnerabilities.

What device users should know

MediaTek's bulletin is aimed primarily at its chipset and device ecosystem, so individual users may not receive a MediaTek-branded security update directly.

Security fixes for products using affected MediaTek chipsets are generally handled through the relevant device manufacturer and software update process.

The bulletin itself does not provide a universal consumer remediation procedure for every affected product.

The practical next step for organizations and users with potentially affected devices is to monitor the security updates provided by the relevant OEM.

MediaTek also says OEMs can contact their MediaTek representative for additional information.

MediaTek's disclosure and patch timeline

MediaTek says OEMs were provided with the issues and corresponding security patches at least two months before publication.

The bulletin was published as version 1.0 on October 5, 2026.

This gives device manufacturers time to incorporate relevant fixes into their own software update processes before the public bulletin becomes available.

The company does not provide a single release date for security updates across all affected products because patch availability depends on the relevant device and OEM.

Report sources include both internal and external findings

MediaTek identifies some vulnerabilities as coming from Internal sources and others as External.

The two Critical modem vulnerabilities, CVE-2026-20519 and CVE-2026-20520, are marked as Internal.

Several of the High-severity vulnerabilities are marked External, while CVE-2026-20526 and CVE-2026-20519/CVE-2026-20520 are identified differently in the bulletin.

The Medium-severity section also contains a mixture of Internal and External report sources.

This indicates that the October bulletin incorporates findings from both MediaTek's internal security work and external vulnerability reporting.

What the bulletin does not disclose

MediaTek's bulletin provides CVE identifiers, affected components, severity classifications, CWE categories, descriptions and affected chipset information.

However, it does not provide information such as:

• A confirmed exploitation campaign

• A named threat actor

• A known victim count

• A confirmed attack chain

• A public exploit

• Device-specific impact across every affected OEM

• A universal consumer patch date

MediaTek explicitly says it was not aware of active exploitation in the wild at publication.

The company also warns that the affected-chipset list may not be complete.

Why the October bulletin matters

Source facts: MediaTek's October bulletin contains 31 vulnerabilities across Critical, High and Medium severity levels. Two Critical vulnerabilities affect the modem, while additional issues affect video, APU, security, display, battery and other components. MediaTek says OEMs were notified at least two months before publication and that it was not aware of active exploitation in the wild.

Analysis: The bulletin highlights the importance of chipset-level security maintenance in devices built on widely used silicon platforms.

A vulnerability disclosed at the chipset level can require coordination between the silicon vendor, device manufacturer and software update process before an end user receives a fix.

The large number of affected chipset variants also means organizations cannot determine exposure solely from the existence of a MediaTek processor. The specific chipset and the device manufacturer's implementation need to be checked.

For security teams managing large device fleets, the bulletin provides CVE identifiers and affected components that can be used to compare against internal hardware inventories and OEM security advisories.

Conclusion

MediaTek's October 2026 Security Bulletin documents 31 vulnerabilities across a broad range of chipset components.

The most serious issues are two Critical modem vulnerabilities involving possible out-of-bounds writes. The bulletin also identifies nine High-severity and 20 Medium-severity vulnerabilities involving memory corruption, privilege escalation, crashes, information disclosure and other weaknesses.

MediaTek says device OEMs received the relevant information and security patches at least two months before publication, and the company was not aware of active exploitation in the wild when the bulletin was released.

For organizations and device owners, the key issue is determining whether a particular product uses an affected chipset and whether its OEM has incorporated the relevant fixes.

Because MediaTek notes that its affected-chipset list may not be complete, organizations should rely on the relevant OEM's security advisory and update information when determining final device exposure.

Additional details were not disclosed in the bulletin.