CVE-2026-20432

CVE-2026-20432 affects a MediaTek modem component, where a missing bounds check could allow an out-of-bounds write. The resulting impact is remote escalation of privilege if a UE connects to a rogue base station; exploitation requires user interaction. Patch MOLY01406170 (MSV-4461) is noted. Conn...

CVE-2026-20485

CVE-2026-20485 affects HFRP, where a missing bounds check enables an out-of-bounds write that can lead to local escalation of privilege when the attacker already has System privileges. Exploitation does not require user interaction. The weakness has a CVSSv3.1 base score of 6.0 (MEDIUM) with LOCA...

CVE-2026-20449

CVE-2026-20449 concerns a vulnerability in Modem where a heap buffer overflow can cause a system crash, leading to remote denial of service. Exploitation could occur if a device connects to a rogue base station controlled by an attacker, with no additional execution privileges and no user interac...

CVE-2026-20484

Technical details about CVE-2026-20484 are not publicly provided in the connected documents. The description notes local information disclosure and a patch ID, but no affected product/version specifics are given. Monitor for updates.

CVE-2026-20488

The CVE-2026-20488 entry describes a vulnerability in a display component where a missing bounds check can lead to local information disclosure if an attacker already has System privileges. No user interaction is required. A patch identified as ALPS11004276 (Issue MSV-7757) is available. The CVSS...

CVE-2026-20475

CVE-2026-20475 describes a local escalation of privilege via an out-of-bounds write in display logic caused by a missing bounds check. Exploitation requires no user interaction and can occur if the attacker already has System privileges. A patch is available (Patch ID ALPS11004276; Issue ID MSV-7...

CVE-2026-20447

Technical details are not publicly available in the provided documents. Monitor for updates from referenced sources (geniezone, patch ALPS10724073, MSV-6296) for affected components, impact, and remediation.

CVE-2026-20473

CVE-2026-20473 involves a memory corruption vulnerability (use-after-free) described as enabling local privilege escalation if an attacker already has System privileges. The issue is triggered in display logic and does not require user interaction for exploitation, with local access as the attack...

CVE-2026-20477

CVE-2026-20477 describes a local privilege escalation flaw where an out-of-bounds write occurs due to a missing bounds check in display code. Successful exploitation could grant SYSTEM-level privileges without user interaction. The vulnerability is associated with Patch ID ALPS11009963 and Issue ...

CVE-2026-20489

Technical details (affected product/vendor/component/version/root cause) are not publicly provided in the supplied documents. The CVE describes an information-disclosure issue from an integer overflow with a patch ID ALPS11004274; monitor for updates.

CVE-2026-20474

Technical details about CVE-2026-20474 (affected products, versions, root cause) are not publicly available in the provided documents. Monitor for updates and forthcoming advisories from vendors and CVE databases.

CVE-2026-20483

CVE-2026-20483 concerns the Telephony component, where a missing permission check enables local escalation of privilege without user interaction. The issue is described as allowing exploitation with only local access and no additional privileges, elevating from NONE. The available data identifies...

CVE-2026-20486

In imgsensor, a local escalation of privilege could occur due to incorrect error handling causing an application crash when a System-privilege context is already held. The advisory notes no user interaction is required for exploitation. The publicly referenced fix is Patch ID ALPS11012302 (Issue ...

CVE-2026-20450

CVE-2026-20450 affects the Modem component. The issue is a crash caused by incorrect error handling, which can lead to remote denial of service if a user equipment connects to a rogue base station controlled by an attacker. No user interaction is required; exploitation is scoped to adjacent acces...

CVE-2026-20448

In geniezone, CVE-2026-20448 is a local privilege-escalation vulnerability caused by a missing permission check. It could allow a user with System privileges to escalate further without user interaction. Patch ALPS10708513 (Issue MSV-6281) is referenced; no exploit details are provided in the doc...

CVE-2026-20431

Summary: CVE-2026-20431 affects MediaTek-based Modem functionality where a logic error can cause a system crash, potentially enabling remote denial of service when a UE connects to a rogue base station. Exploitation reportedly requires no user interaction and can occur with adjacent access; no ad...