MediaTek Kicks Off 2026 with Major Security Overhaul for Mobile Chipsets

MediaTek kicked off 2026 with a security bulletin that patches a range of high‑severity flaws across its mobile and IoT chipsets, including the Dimensity line used in many high‑end smartphones. The January 2026 update, published on 5 January 2026, addresses several issues in the modem firmware that could cause crashes or allow arbitrary code execution.

Among the notable flaws are CVE-2025-20794 (Stack Overflow), CVE-2025-20793 (Null Pointer Dereference), and CVE-2025-20762 and CVE-2025-20760 (Reachable Assertion errors), affecting a broad list of chipsets such as MT6989, MT6991 and MT6580. There is also a high‑severity Out-of-bounds Write in the KeyInstall component (CVE-2025-20795) that could allow memory to be overwritten in a security subsystem.

Beyond the modem, the bulletin covers dozens of medium‑severity issues across subsystems like Display & Graphics, Battery & Power, and the Deep Processing Engine, including multiple Use After Free, Double Free and Integer Overflow flaws.

According to MediaTek, device OEMs have been notified of all issues and the patches at least two months before publication, giving manufacturers a head start on integrating fixes into monthly updates; users should expect the January 2026 security patch level from their device makers to stay protected.