MediaTek's October Bulletin Puts 31 Chipset Flaws Behind One Firmware Update

TL;DR

• The MediaTek Product Security Bulletin is a monthly public list of security flaws in the company's chipsets, published with a CVSS severity score and the chip names each flaw affects.
• The October 2026 edition went up on 5 October and lists 31 vulnerabilities across smartphone, tablet, automotive and IoT chipsets: two Critical, nine High and twenty Medium.
• The two Critical flaws are modem bugs, CVE-2026-20519 and CVE-2026-20520, both out-of-bounds writes that a rogue base station can trigger on a connected device with no action from the user.
• MediaTek states that device makers were notified of every issue and given the corresponding patches at least two months before publication, so the fix sits inside each device maker's own firmware build.
• A device owner sees the fix only when it reaches that maker's update, and the bulletin notes no active exploitation in the wild at publication, which turns a short CVE list into an inventory question for anyone running these chips.

What the October bulletin contains

The MediaTek Product Security Bulletin is the company's public record of flaws in its own silicon, published monthly with the CVSS v3.1 base score and the list of chipsets each flaw affects. The October 2026 edition carries 31 CVEs: two rated Critical, nine High and twenty Medium, spanning smartphone SoCs, tablet and Chromebook chips, automotive and IoT modems.

Two details in the bulletin shape how a business should read it. Every issue was reported internally, which the detail blocks record as the report source, so this is vendor-side discovery rather than a list assembled from outside reports. MediaTek also states plainly that at the time of publication it is "not aware of any active exploitation of these vulnerabilities in the wild", a claim that describes the state of the world on 5 October and nothing later.

The two critical modem flaws

Both Critical entries sit in the modem. CVE-2026-20519 and CVE-2026-20520 are out-of-bounds writes caused by a missing bounds check, and the CVE record describes the consequence for the first one: remote escalation of privilege if the device has connected to a rogue base station the attacker controls, with no additional execution privileges required and no user interaction.

That precondition is worth taking seriously in both directions. A rogue base station is a real and cheap attack, a software radio and a laptop, exploited in the field for years against phones that fall back to older network standards. The same precondition limits who is exposed: a device that never attaches to an attacker-controlled cell site never meets the trigger. The affected list is long in the other direction, running from MT2716 and MT2735 up to MT8873, MT8883 and MT8893, which covers a decade of shipping silicon.

The High band holds its own surprises. CVE-2026-20586 is an out-of-bounds write in the video decoder scored 8.8, leading to remote privilege escalation when a user interacts with crafted content, and two more modem flaws let a rogue base station crash a device. The remaining High entries sit in the NeuroPilot AI framework, the APU driver and the Video HAL, all reachable by a local attacker holding elevated rights.

Two months of head start for device makers

The sentence that matters most for planning is the notification statement: device makers were told about every issue and given the patches at least two months before the 5 October publication. That is an unusually clear disclosure timeline, and it explains the shape of the bulletin. The public document arrives after the fixes have already circulated to the companies that build the devices.

Two months also measures the distance between a vendor patch and a device you can hold. Each maker folds the fix into a firmware build for the specific chipsets it shipped, that build passes carrier and regional certification, and the result lands as a system update with a version number the user never reads. None of those steps is slow on its own, and the sequence is long.

Why the fix reaches you late

A vulnerability in a modem is unusual because the component sits in the device and its firmware ships with the device. There is no server to patch, no agent to push and no configuration file to change. The patch path runs through the party that assembled the hardware, and it stops for anything already outside its support window.

That creates an inventory problem with hard edges. A company's phone fleet, its tablets, its cellular routers, its connected sensors and its industrial modules can carry the same affected baseband in four different update regimes. Some makers publish security bulletins with monthly cadence and some do not publish them at all, and older devices simply stop receiving builds.

For anyone running these chips in volume, the practical questions are short. Which makers keep publishing security updates for the models you own. Which models have reached end of support. Which devices connect to networks you do not control. Which of those devices hold data worth protecting. The answers live in procurement records and a device management console, and building them takes an afternoon rather than a project.

An inventory question for anyone running these devices

The bulletin itself points at the action, and MediaTek's own guidance is the one that works everywhere: apply the latest security updates from your device maker. The companies that follow that instruction well are the ones whose asset register already names the model, the maker and the firmware version of every device, which is the same register that answers an insurance question or an audit request.

Monitoring has a part to play in the edge cases, since a device that misbehaves on a cellular link is hard to see from inside a corporate network. Our note on infrastructure monitoring with plain-language alerts covers how that signal reaches a person who can act on it. The pattern here mirrors the one in our analysis of the five legacy flaws CISA added to its exploited-vulnerability catalogue, where the list was the beginning of the work.

Worth stating plainly for anyone reading the severity table alone: the two flaws at the top of this bulletin need an attacker with a base station near your device, and the vendor reports no exploitation to date. That is a reason for calm scheduling and a reason to know which devices you own.

Sources

Source: October 2026 MediaTek Product Security Bulletin — MediaTek, published 2026-10-05 — https://www.mediatek.com/product-security-bulletin/October-2026, retrieved 2026-10-10 (device OEMs notified of all issues and the corresponding security patches at least two months before publication; MediaTek states it is not aware of any active exploitation of these vulnerabilities in the wild; severity assessed on CVSS v3.1; summary of 2 Critical, 9 High and 20 Medium CVEs; CVE-2026-20519 detail block recording the Modem subcomponent, Critical severity, CWE-787 out-of-bounds write, the description of a possible out of bounds write due to a missing bounds check, report source Internal, and the affected-chipset list).

Source: CVE record for CVE-2026-20519 — CVE Program, updated 2026-10-05, retrieved 2026-10-10 — https://www.cve.org/CVERecord?id=CVE-2026-20519 (remote escalation of privilege if a UE has connected to a rogue base station controlled by the attacker, no additional execution privileges needed, no user interaction needed for exploitation, patch ID MOLY01778993, issue ID MSV-8898, 57 affected chipset versions with the default status unaffected).

Source: MediaTek Security Bulletin summary, October 2026 — SecurityOnline, published 2026-10-05, retrieved 2026-10-10 — https://securityonline.info/mediatek-security-bulletin-october-2026 (both critical modem flaws are out-of-bounds writes caused by a missing bounds check requiring a victim device to connect to a rogue base station, with no action needed from the victim; CVE-2026-20586 is an out-of-bounds write in the video decoder rated 8.8; CVE-2026-20525 and CVE-2026-20527 allow denial of service from a rogue base station; remaining high-severity flaws sit in the NeuroPilot AI framework, the APU driver and the Video HAL; most medium flaws require an attacker who already holds System privileges; affected critical modem chipsets including MT2735, MT2737, MT6833, MT6853, MT6877, MT6893, MT6983, MT6985, MT6989, MT6991 and MT6993; fixes reach users only through OEM firmware updates).

Source: MediaTek Product Security Bulletin for October 2026 and the CVE Program record for CVE-2026-20519 — mediatek.com and cve.org, published 5 October 2026, retrieved 2026-10-10. Figures from the bulletin's severity summary and detail blocks; images are captures of the official MediaTek bulletin page taken 2026-10-10.