CVE-2026-20529: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability (CWE-787) involves an out-of-bounds write in the battery component of MediaTek chipsets due to a missing bounds check. An attacker who already has System privileges could exploit this flaw locally to escalate their privileges further. The vulnerability affects a wide range of MediaTek chipset models, including MT6761, MT6765, MT6768, MT6781, MT6853, MT6858, MT6881, MT6893, MT6989, MT6991, MT6993, MT8171, MT8186, MT8188, MT8189, MT8196, MT8766, MT8768, MT8775, MT8781, MT8792, MT8796, MT8799, MT8883, MT8893, and MT8910. No user interaction is required for exploitation. The patch status is not confirmed based on the provided data.

The vulnerability allows local escalation of privilege for an attacker who already has System privileges on the affected MediaTek chipsets. This could lead to unauthorized actions at a higher privilege level. There is no indication of remote exploitation or requirement for user interaction. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to systems with affected MediaTek chipsets to trusted users with System privileges to reduce risk.