CVE-2024-20146

CVE-2024-20146

Vendor Mediatek, Inc.

Product MT2737, MT3603, MT6835, MT6878, MT6886, MT6897, MT6990, MT7902, MT7920, MT7922, MT8365, MT8518S, MT8532, MT8666, MT8667, MT8673, MT8755, MT8766, MT8768, MT8775, MT8781, MT8786, MT8788, MT8796, MT8798, MT8893

Weakness CWE-787

Published January 6, 2025

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In wlan STA driver, there is a possible out of bounds write due to improper input validation. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00389496 / ALPS09137491; Issue ID: MSV-1835.

Key dates

02Disclosure timeline

January 6, 2025 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-20146 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/787.html

Related vulnerabilities

Identifiers

CVE CVE-2024-20146

CWE CWE-787

Affected versions

Vendor Mediatek, Inc.

Affected Android 13.0, 14.0, 15.0 / SDK release 2.5 and before / openWRT 23.05 / Yocto 3.3, 4.0, 5.0

01Description

02Disclosure timeline

03References

04Related CVE