This vulnerability (CVE-2026-20497) involves an out-of-bounds write (CWE-787) in the geniezone component of MediaTek chipsets due to a missing bounds check. An attacker with existing System privileges could exploit this flaw to escalate privileges locally. The issue affects several MediaTek chipset models including MT6989, MT8755, MT8768, MT8771, MT8775, MT8781, MT8792, MT8796, MT8797, and MT8798. No user interaction is required for exploitation. The CVSS 3.1 vector is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, reflecting local attack vector, low complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact but no availability impact. No vendor advisory or patch information is provided in the input, and no known exploits are reported in the wild.

Successful exploitation could allow a local attacker with System privileges to escalate their privileges further, potentially compromising confidentiality and integrity of the affected system components. There is no impact on availability. The vulnerability requires the attacker to already have high-level privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The input references patch IDs ALPS10965550 and ALPS11393405 but does not confirm availability or deployment of patches. Until official patches or mitigations are confirmed, restrict local access to trusted users and monitor for suspicious activity related to privilege escalation attempts.