CVE-2026-20407
Published: 02 February 2026
Summary
CVE-2026-20407 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Mediatek Nbiot Sdk. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates validation of all inputs, including bounds checks, to directly prevent out-of-bounds writes in the WLAN STA driver.
Enforces memory protections like stack canaries and address space randomization to mitigate exploitation of missing bounds checks via out-of-bounds writes.
Requires timely flaw remediation through patching, such as applying WCNCR00464377, to fix the missing bounds check in the MediaTek WLAN STA driver.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of out-of-bounds write in kernel driver (CWE-787).
NVD Description
In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00464377;…
more
Issue ID: MSV-4905.
Deeper analysisAI
CVE-2026-20407 is a high-severity vulnerability in the wlan STA driver, stemming from a missing bounds check that enables an out-of-bounds write (CWE-787). This flaw affects MediaTek's wireless LAN station driver components, potentially present in devices using MediaTek chipsets. The issue allows local escalation of privilege, as scored at CVSS 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating low complexity exploitation with high impact on confidentiality, integrity, and availability across a scoped change.
A local attacker with user execution privileges can exploit this vulnerability without requiring user interaction. By triggering the missing bounds check in the wlan STA driver, the attacker achieves local escalation of privilege, potentially gaining kernel-level access or higher privileges on the affected system.
MediaTek's February 2026 Product Security Bulletin addresses this issue, providing mitigation via Patch ID WCNCR00464377 for Issue ID MSV-4905. Security practitioners should apply the referenced patch to vulnerable MediaTek wlan STA driver implementations to prevent exploitation.
Details
- CWE(s)