# CVE-2026-20462: MediaTek Chipset heap buffer overflow in Telephony

Source: https://junglewise.ai/threats/cve-2026-20462-mediatek-chipset-heap-buffer-overflow-in-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-20462 · Severity: info · Published 2026-07-01

A security vulnerability exists in the Telephony component of several MediaTek chipsets used in mobile devices. If an attacker already has significant control over a device, they could exploit this flaw to gain even higher levels of system access. This could allow for deeper persistence on the device or unauthorized access to sensitive functions, though it requires the attacker to have already breached the device's initial security layers.

## Quick answers

**Is CVE-2026-20462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20462 being exploited in the wild.

**How severe is CVE-2026-20462?** Informational severity, published 1 July 2026.

**Which products and versions are affected?** MediaTek MT6739; MediaTek MT6761; MediaTek MT6765; MediaTek MT6768; and 18 more.

**Is there a fix for CVE-2026-20462?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20462 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-20462?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the Telephony component of various MediaTek chipsets. The vulnerability allows for memory corruption which can be leveraged for local escalation of privilege. A precondition for exploitation is that the attacker must have already obtained System-level privileges on the device. No user interaction is required for successful exploitation. MediaTek has released a patch under ID ALPS11006447 to address this issue.

## Affected products

- MediaTek MT6739
- MediaTek MT6761
- MediaTek MT6765
- MediaTek MT6768
- MediaTek MT6781
- MediaTek MT6789
- MediaTek MT6833
- MediaTek MT6853
- MediaTek MT6855
- MediaTek MT6877
- MediaTek MT6883
- MediaTek MT6885
- MediaTek MT6889
- MediaTek MT6893
- MediaTek MT8695
- MediaTek MT8696
- MediaTek MT8765
- MediaTek MT8766
- MediaTek MT8766R
- MediaTek MT8768
- MediaTek MT8781
- MediaTek MT8791

## Timeline

- 2026-07-01: advisory
- 2026-07-01: disclosed

## References

- [https://corp.mediatek.com/product-security-bulletin/July-2026](https://corp.mediatek.com/product-security-bulletin/July-2026)