CVE-2026-20530: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability involves an out-of-bounds write in the display subsystem of MediaTek chipsets due to a missing bounds check. The flaw could be exploited by a local attacker who already has System privileges to escalate their privileges further. No user interaction is required for exploitation. The affected chipsets include MT2718, MT6991, MT6993, MT8126, MT8171, MT8188, MT8189, MT8196, MT8668, MT8678, and MT8793. The issue is tracked under Patch ID ALPS11292777 and Issue ID MSV-9195. No CVSS score or detailed vendor advisory is provided.

The vulnerability allows local escalation of privilege on affected MediaTek chipsets if the attacker already has System-level access. This could lead to increased control over the device or system components. There is no indication of remote exploitation or requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance referencing Patch ID ALPS11292777. Until an official fix is confirmed, limit local access to trusted users and monitor for suspicious activity. No vendor advisory content explicitly confirms patch availability or no-action status.