CVE-2026-20544: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability (CVE-2026-20544) involves an out-of-bounds write in MediaTek chipsets due to a missing bounds check in the 'meta' component. The flaw enables local privilege escalation if an attacker has physical access to the device, without requiring additional execution privileges or user interaction. The affected products include a wide range of MediaTek chipset models. The issue is tracked under MediaTek patch IDs ALPS11049530 and ALPS11480843 and issue ID MSV-7935. No CVSS score or detailed exploit information is available in the provided data.

An attacker with physical access to a device containing an affected MediaTek chipset could exploit this vulnerability to escalate privileges locally. This could potentially allow unauthorized access or control over device functions that require elevated privileges. No remote exploitation or user interaction is required, increasing the risk in scenarios where physical device access is possible.

Patch status is not yet confirmed—check the MediaTek vendor advisory for current remediation guidance. The vendor has identified patch IDs related to this issue, indicating that fixes may exist or are in development. Until official patches are confirmed and applied, restrict physical access to affected devices to mitigate exploitation risk.