CVE-2026-20528: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability (CVE-2026-20528) involves an out-of-bounds write and read in the ccci component of MediaTek chipsets caused by a missing bounds check. The issue can be exploited locally by an attacker who already has System privileges, potentially resulting in information disclosure, memory corruption, application crashes, or privilege escalation. The affected chipsets include MT2735, MT2737, MT6813, MT6880, MT6890, MT6986, MT6988, and MT6990. Patch identifiers are provided for different chipset models, but no explicit patch availability status or vendor advisory content is included in the data.

The vulnerability allows local attackers with System privilege to cause memory corruption, crashes, information disclosure, or escalate privileges further. Since exploitation requires existing System privilege and user interaction, the risk is limited to local threat scenarios. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided patch IDs suggest fixes exist for various chipset models, but official confirmation or availability of patches is not included. Until patches are confirmed and applied, limit local access to trusted users and monitor for suspicious activity related to the ccci component.