CVE-2026-20452: In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow

Synopsis

This is a heap buffer overflow in the MediaTek WLAN AP driver affecting chipsets MT6890, MT7615, MT7915, and MT7916. An attacker on the same local network or adjacent wireless segment who holds a low-privilege user account can send a crafted request that corrupts heap memory, requiring no victim interaction. Successful exploitation gives the attacker full code execution on the affected device with arbitrary read, write, and availability impact. No fix version has been published; HarborGuard tracks the MediaTek advisory for patch availability and will surface a patched rebuild the moment one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (local LAN, wireless BSS, or VPN) as the target; remote over-the-internet exploitation is not possible with this attack vector.

• AuthenticationRequired

  A low-privilege user account on the target system or network context is required; unauthenticated exploitation is not possible.

• Victim interactionNot required

  No action from a victim user is needed; the attacker can trigger the heap overflow without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Reads protected memory regions, exposing credentials, session state, or other sensitive data held by the driver.
• Writes arbitrary data into heap memory, allowing the attacker to overwrite function pointers or control structures and achieve code execution.
• Crashes or destabilizes the WLAN AP driver process, taking down wireless connectivity for all clients associated with the affected access point.
• With code execution at driver privilege level, an attacker can persist malicious code or pivot to other network-adjacent systems.