IoT Yocto 2026 Security Bulletin Published

Product Security Bulletin contains details of security vulnerabilities affecting MediaTek IoT Yocto devices. Device OEMs should regularly review and update all the issues of the corresponding security patches before publication.

December 2026 

November 2026 

October 2026 

CVE-2026-20542 

Subcomponent	apusys
Severity	Medium
CWE	CWE-416 Use After Free
Description	There is a possible memory corruption due to use after free.
Affected Chipsets	MT8391,MT8371,MT8371LV,MT8367,MT8366
References	Commit 93ab5767

September 2026 

August 2026 

CVE-2026-20469 

Subcomponent	trusted_mem
Severity	High
CWE	CWE-123 Write-what-where Condition
Description	There is a possible escalation of privilege due to improper input validation.
Affected Chipsets	MT8395,MT8391,MT8371,MT8371LV,MT8390,MT8370,MT8365
References	Commit 007c63cb , 678f71ce , 2e60986f , 0c3d7102

CVE-2026-20486 

Subcomponent	imgsensor
Severity	Medium
CWE	CWE-754 Improper Check for Unusual or Exceptional Conditions
Description	There is a possible application crash due to incorrect error handling.
Affected Chipsets	MT8395,MT8390,MT8370
References	Commit 5a75a672

July 2026 

June 2026 

May 2026 

CVE-2025-10263 

Subcomponent	CPU
Severity	Critical
CWE
Description	Please refer to the Arm CPU Security Bulletin.
Affected Chipsets	MT8395,MT8391,MT8371,MT8371LV,MT8390,MT8370,MT8367,MT8366
References	Commit 6550fa97 , 24eef642

April 2026 

March 2026 

February 2026 

CVE-2026-20411 

Subcomponent	cameraisp
Severity	Medium
CWE	CWE-416 Use After Free
Description	There is a possible escalation of privilege due to use after free.
Affected Chipsets	MT8395,MT8390,MT8370
References	Commit cf75c0c2

CVE-2026-20412 

Subcomponent	cameraisp
Severity	Medium
CWE	CWE-787 Out-of-bounds Write
Description	There is a possible out of bounds write due to a missing bounds check.
Affected Chipsets	MT8395,MT8390,MT8370
References	Commit cf75c0c2