Out of Bounds Write Vulnerability in MediaTek vdec Software
CVE-2023-20809

6.7MEDIUM

Key Information:

Vendor

MediaTek
Status
Mt5583, Mt5691, Mt5695, Mt9010, Mt9011, Mt9012, Mt9016, Mt9020, Mt9021, Mt9022, Mt9030, Mt9031, Mt9032, Mt9215, Mt9216, Mt9218, Mt9220, Mt9221, Mt9222, Mt9255, Mt9256, Mt9266, Mt9269, Mt9285, Mt9286, Mt9288, Mt9600, Mt9602, Mt9610, Mt9611, Mt9612, Mt9613, Mt9615, Mt9617, Mt9629, Mt9630, Mt9631, Mt9632, Mt9636, Mt9638, Mt9639, Mt9650, Mt9652, Mt9666, Mt9667, Mt9669, Mt9670, Mt9671, Mt9675, Mt9685, Mt9686, Mt9688
Vendor
CVE Published:
7 August 2023

What is CVE-2023-20809?

The vdec software by MediaTek is susceptible to an out of bounds write due to insufficient bounds checking. This weakness can allow attackers to escalate privileges on local systems, potentially leading to unauthorized system execution. Importantly, user interaction is not required for exploitation, making this a significant risk for affected systems. It is crucial for users to apply the necessary patches to mitigate this vulnerability.

Affected Version(s)

MT5583, MT5691, MT5695, MT9010, MT9011, MT9012, MT9016, MT9020, MT9021, MT9022, MT9030, MT9031, MT9032, MT9215, MT9216, MT9218, MT9220, MT9221, MT9222, MT9255, MT9256, MT9266, MT9269, MT9285, MT9286, MT9288, MT9600, MT9602, MT9610, MT9611, MT9612, MT9613, MT9615, MT9617, MT9629, MT9630, MT9631, MT9632, MT9636, MT9638, MT9639, MT9650, MT9652, MT9666, MT9667, MT9669, MT9670, MT9671, MT9675, MT9685, MT9686, MT9688 Android 10.0, 11.0

References

https://corp.mediatek.com/product-security-bulletin/Augus...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.