CVE-2026-20491 Memory corruption in MediaTek chipset

Medium 5.5 Published 3 Aug 2026 Updated 3 Aug 2026

A local attacker can cause a denial of service via an out-of-bounds write in MediaTek chipset firmware.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-20491?

CVE-2026-20491 is a medium-severity memory corruption vulnerability in MediaTek, Inc. MediaTek chipset, published on 3 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652.

Weakness: CWE-787

Which versions are affected by CVE-2026-20491?

It affects 5 products.

Products include Mediatek Mt2735 Firmware, Mediatek Mt2737 Firmware, Mediatek Mt6890 Firmware, Mediatek Mt6988 Firmware, Mediatek Mt6990 Firmware.

How do I fix CVE-2026-20491?

No fix has been published for CVE-2026-20491 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-20491 being exploited?

There is no known exploitation of CVE-2026-20491 in the wild and no public exploit code.

Sources

Also known as GHSA-639g-9ffj-23fc.