What is CVE-2026-20491?

CVE-2026-20491 is a medium-severity vulnerability in Mediatek Mt2735 Firmware, classified under Out-of-bounds Write. CVSS score: 5.5/10. Published 2026-08-03.

How severe is CVE-2026-20491?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Buffer overflow in Mediatek Mt2735 Firmware

CVE-2026-20491

In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652.

Vulnerability class: Buffer Overflow

EPSS: 0.001 (1.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Mediatek Mt2735_firmware
Mediatek Mt2737_firmware
Mediatek Mt6890_firmware
Mediatek Mt6988_firmware
Mediatek Mt6990_firmware
Mediatek, Inc. Mediatek Chipset — versions MT2735, MT2737, MT6890

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

security@mediatek.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-20491?: CVE-2026-20491 is a medium-severity vulnerability in Mediatek Mt2735 Firmware, classified under Out-of-bounds Write. CVSS score: 5.5/10. Published 2026-08-03.
How severe is CVE-2026-20491?: Medium severity. CVSS v3 base score is 5.5 out of 10.