CVE-2022-26447

Summary of CVE-2022-26447 : A MediaTek BT firmware vulnerability causes an out-of-bounds write due to a missing bounds check. This can enable remote code execution with no privileges and no user interaction required. Affected component is BT firmware (MediaTek). The issue is associated with patch...

CVE-2023-20623

CVE-2023-20623 affects the Ion component in MediaTek-based systems. Root cause is improper locking that allows local privilege escalation without extra execution privileges and with no user interaction required. The CVSS metrics indicate a local attack vector, high complexity, and high privileges...

CVE-2022-26434

CVE-2022-26434 describes an out-of-bounds write in the mailbox caused by a missing bounds check, enabling local escalation to System privileges without user interaction. Public references across NVD/Red Hat and related feeds identify the patch ID ALPS07138450 (Issue ALPS07138450) as the remediati...

CVE-2022-26433

The CVE-2022-26433 entry concerns MediaTek mailbox (mailbox controller) with a type-confusion caused out-of-bounds write leading to local privilege escalation to SYSTEM. Affected component: mailbox handling in MediaTek devices; root cause: type confusion resulting in out-of-bounds write (exact co...

CVE-2022-26430

CVE-2022-26430 affects MediaTek devices with a mailbox type confusion leading to out-of-bounds write. This can enable local privilege escalation to SYSTEM level with no user interaction required. Patch ALPS07032521 (Issue ALPS07032521) referenced in multiple sources; no remediation details beyond...

CVE-2022-26431

CVE-2022-26431 affects the MediaTek mailbox controller and is described as an out-of-bounds write caused by a missing bounds check. The issue could allow local escalation of privilege to System level with no user interaction required. Documented impact is high for confidentiality, integrity, and ...

CVE-2022-26465

CVE-2022-26465 relates to MediaTek audio IPI, where an incorrect bounds check can trigger an out-of-bounds write in the audio IPI component. The vulnerability could enable local escalation of privilege with SYSTEM execution privileges, and does not require user interaction for exploitation. A pat...

CVE-2022-26435

CVE-2022-26435: A type confusion in the mailbox component can cause an out-of-bounds write, enabling local privilege escalation to System level without user interaction. Documents (NVD/Red Hat/NVD list) cite Patch ALPS07138435/Issue ALPS07138435 as the remediation. Exploitation status is not prov...

CVE-2022-32631

CVE-2022-32631 concerns MediaTek-based Wi‑Fi stacks with an outwardly stated vulnerability: an out-of-bounds write caused by improper input validation. The consequence is local escalation of privilege with SYSTEM execution privileges required, and exploitation reportedly does not require user int...

CVE-2022-32633

CVE-2022-32633 affects MediaTek Wi‑Fi components with a logic error that can cause a memory access violation, enabling local privilege escalation without user interaction. Root cause: memory access violation in Wi‑Fi code; impact据 indicate Local, Privileges required HIGH, with System execution pr...

CVE-2022-32632

CVE-2022-32632 affects MediaTek Wi‑Fi components (Chip/SoC) with an out-of-bounds write caused by improper input validation, enabling local escalation of privilege with SYSTEM privileges and no user interaction required. Patch ALPS07441630/ALPS07441630 issued; no exploitation details provided in ...

CVE-2023-20660

CVE-2023-20660 affects the WLAN component in MediaTek devices, with an out-of-bounds read caused by an integer overflow that can lead to local information disclosure. Exploitation requires SYSTEM-level privileges, and no user interaction is needed. A patch is referenced (ALPS07588383 / ALPS075883...

CVE-2023-20661

CVE-2023-20661 affects the wlan component (MediaTek-related stack) and is caused by an out-of-bounds write resulting from an integer overflow. The vulnerability can lead to local privilege escalation with System execution privileges required and does not require user interaction. Reported impact ...

CVE-2023-20679

CVE-2023-20679 affects MediaTek WLAN in which a missing bounds check allows an out-of-bounds read, enabling local escalation of privilege without user interaction. Impact: confidentiality impact listed as high; privilege requirement is high with local attack vector, no UI interaction needed. Root...

CVE-2022-26466

The CVE-2022-26466 entry concerns the Mediatek audio IPI component. The root cause is an integer overflow that enables an out-of-bounds write, resulting in local privilege escalation with SYSTEM privileges required and no user interaction needed. Public references indicate a patch identified as A...

CVE-2023-20659

CVE-2023-20659 concerns a local out-of-bounds write in the WLAN path of a MediaTek/ALPS component, caused by a missing bounds check. The issue can lead to local privilege escalation with System execution privileges needed; exploitation does not require user interaction. The patch reference provid...

CVE-2023-20662

The CVE-2023-20662 entry describes a vulnerability in the wlan component where an integer overflow causes an out-of-bounds write. This could enable local escalation of privilege with SYSTEM-level execution privileges and requires no user interaction. A patch is identified as ALPS07560765 (Issue A...

CVE-2023-20682

CVE-2023-20682 affects the MediaTek wlan component, describing an out-of-bounds write caused by an integer overflow that could enable local privilege escalation with system execution privileges required. User interaction is not needed. A patch is noted: ALPS07441605 (Issue ALPS07441605). Connecte...

CVE-2023-20663

CVE-2023-20663 describes a potential out-of-bounds write in wlan due to an integer overflow, enabling local privilege escalation with System execution privileges required and no user interaction. The vulnerability is tied to a patch ID ALPS07560741 / Issue ID ALPS07560741. Connected sources menti...

CVE-2022-26432

CVE-2022-26432 affects MediaTek-based devices where a mailbox out-of-bounds write due to a missing bounds check can enable local privilege escalation with System privileges. Public details consistently describe the issue without user interaction; no exploit details are provided in the documents. ...

CVE-2023-20675

CVE-2023-20675 concerns MediaTek platforms where the kernel/wlan component is vulnerable to an out-of-bounds read caused by a missing bounds check. The issue can lead to local information disclosure, with potentially full System privileges if exploited, and does not require user interaction. Conn...

CVE-2023-20676

CVE-2023-20676 is an out-of-bounds read vulnerability in the WLAN component of MediaTek devices (notably affecting Mediatek WLAN stacks such as MT5221 and similar chips). The underlying issue is a missing bounds check, enabling local information disclosure and, per the description, potentially al...

CVE-2023-20674

The CVE-2023-20674 issue affects the WLAN component in MediaTek devices, caused by an out-of-bounds read due to a missing bounds check. This vulnerability could allow local information disclosure and may enable system-level execution privileges, with no user interaction required. Multiple feeds (...

CVE-2023-20718

CVE-2023-20718 affects the vcu module in MediaTek chip families. The root cause is an out-of-bounds write caused by a missing bounds check, enabling local escalation of privilege with System execution privileges required and no user interaction needed. The entry lists patch ALPS07645181/ALPS07645...

CVE-2023-20677

The CVE-2023-20677 issue affects the wlan component in MediaTek-based devices, caused by a missing bounds check leading to an out-of-bounds read. Impact is local information disclosure with SYSTEM-level execution privileges required, and exploitation reportedly does not require user interaction. ...

CVE-2023-20721

CVE-2023-20721 concerns the isp module in MediaTek chips, where an out-of-bounds write caused by improper input validation could enable local privilege escalation with SYSTEM privileges. Exploitation details are not provided in the documents; user interaction is not required. A patch/issue identi...