CVE-2024-20119: mt6739 Memory Corruption — Fix

Description

In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09062301; Issue ID: MSV-1620.

Is your site exposed to CVE-2024-20119?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.7

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-123 CWE-123

CWE-787 Out-of-bounds Write

Affected Products

Vendor	Product	Versions
google	android	All
google	android	All
google	android	All
google	android	All
mediatek	mt6739	All
mediatek	mt6761	All
mediatek	mt6765	All
mediatek	mt6768	All
mediatek	mt6779	All
mediatek	mt6781	All
mediatek	mt6785	All
mediatek	mt6789	All
mediatek	mt6833	All
mediatek	mt6835	All
mediatek	mt6853	All
mediatek	mt6855	All
mediatek	mt6873	All
mediatek	mt6877	All
mediatek	mt6883	All
mediatek	mt6885	All
mediatek	mt6889	All
mediatek	mt6893	All
mediatek	mt8676	All

References

Advisories & Patches

https://corp.mediatek.com/product-security-bulletin/November-2024

Frequently Asked Questions

What is CVE-2024-20119? +

In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09062301; Issue ID: MSV-1620. It has a CVSS v3.1 base score of 6.7 (MEDIUM).

How severe is CVE-2024-20119? +

CVE-2024-20119 has a CVSS v3.1 score of 6.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-20119? +

CVE-2024-20119 affects products from google, mediatek, specifically: android, mt6739, mt6761, mt6765, mt6768, mt6779, mt6781, mt6785, mt6789, mt6833, mt6835, mt6853, mt6855, mt6873, mt6877, mt6883, mt6885, mt6889, mt6893, mt8676. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-20119? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c …

CVE-2024-42479 10.0

llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. …

CVE-2026-30121 9.1

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.

CVE-2026-94146 8.8

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys …

CVE-2026-81579 8.8

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows …

CVE-2026-94129 8.8

A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of …

CVE-2024-20119