CVE-2026-20523: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

The vulnerability CVE-2026-20523 involves an out-of-bounds write (CWE-787) in the neuropilot component of MediaTek chipsets due to a missing bounds check. This flaw allows an attacker with local access to escalate privileges without needing further execution privileges or user interaction. The affected chipsets include MT6881, MT6993, MT8188, MT8189, MT8668, MT8781, MT8793, MT8875, and MT8910. The issue is tracked under Patch ID ALPS11249062 and Issue ID MSV-9171. No CVSS score or detailed vendor advisory is available to confirm patch status.

Successful exploitation of this vulnerability can lead to local escalation of privilege on affected MediaTek chipsets. No additional execution privileges or user interaction are required, increasing the risk in environments where local access is possible. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. The referenced Patch ID ALPS11249062 suggests a fix may exist, but without explicit confirmation, users should monitor MediaTek advisories and apply updates once available.