# CVE-2026-20476: MediaTek ccci out of bounds read due to missing bounds check

Source: https://junglewise.ai/threats/cve-2026-20476-mediatek-ccci-out-of-bounds-read-due-to-missing-bounds-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20476 · Severity: medium · CVSS 5.5 · Published 2026-08-03

MediaTek's ccci is a component used in cellular modems across smartphones and IoT devices. A missing bounds check allows an attacker with local access to read memory outside of allocated buffers, potentially causing system crashes or information disclosure.

Technologies: [MediaTek MT6813](https://junglewise.ai/threats/technologies/mt6813), [MediaTek Mt6813 Firmware](https://junglewise.ai/threats/technologies/mt6813-firmware), [MediaTek Mt6986](https://junglewise.ai/threats/technologies/mt6986), [MediaTek Mt6986 Firmware](https://junglewise.ai/threats/technologies/mt6986-firmware), [MediaTek MT6988](https://junglewise.ai/threats/technologies/mt6988), [MediaTek Mt6988 Firmware](https://junglewise.ai/threats/technologies/mt6988-firmware). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek).

## Quick answers

**Is CVE-2026-20476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20476 being exploited in the wild.

**How severe is CVE-2026-20476?** Medium severity, with a CVSS score of 5.5, published 3 August 2026.

**Which products and versions are affected?** MediaTek Ccci <UNKNOWN>.

**Is there a fix for CVE-2026-20476?** A patch was published on 2026-08-03: Patch ID: ALPS10981532 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20476 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-20476?** Check whether you run MediaTek Ccci, MediaTek MT6813, MediaTek Mt6813 Firmware or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an out-of-bounds read in the ccci (Cellular Control Communication Interface) component resulting from a missing bounds check. The vulnerability requires local user execution privileges, but does not require user interaction for exploitation. An attacker can trigger the out-of-bounds read to cause denial of service through system crashes or potentially leak sensitive memory contents. MediaTek has issued a security patch with ID ALPS10981532 and this is tracked as Issue ID MSV-7660.

## Affected products

- MediaTek ccci <UNKNOWN>

## Timeline

- 2026-08-03: disclosed
- 2026-08-03: patched: Patch ID: ALPS10981532

## References

- [https://www.mediatek.com/product-security-bulletin/August-2026](https://www.mediatek.com/product-security-bulletin/August-2026)

## Related threats

- [MediaTek ccci out of bounds write](https://junglewise.ai/threats/cve-2026-20552-in-ccci-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek vdec out-of-bounds write in type confusion](https://junglewise.ai/threats/cve-2026-20579-in-vdec-there-is-a-possible-out-of-bounds-write-due-to-type)
- [MediaTek out of bounds write in modem](https://junglewise.ai/threats/cve-2026-20544-in-meta-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek Modem information disclosure due to logic error](https://junglewise.ai/threats/cve-2026-20543-in-modem-there-is-a-possible-information-disclosure-due-to-a)
- [MediaTek Modem out-of-bounds read due to missing permission check](https://junglewise.ai/threats/cve-2026-20538-in-modem-there-is-a-possible-out-of-bounds-read-due-to-a-missing)