CVE-2026-20579: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability involves an out-of-bounds write in the vdec component of MediaTek chipsets due to type confusion. The flaw could enable a local escalation of privilege if the attacker already has System-level access. The issue affects a broad range of MediaTek chipset models including MT2718, MT6768, MT6769, MT6789, MT6833, MT6855, MT6877, MT8186, MT8188, MT8189, MT8195, MT8196, MT8367, MT8391, MT8395, MT8668, MT8676, MT8678, MT8696, MT8781, MT8792, MT8793, MT8799, and MT8910. No user interaction is required for exploitation. The patch status is not confirmed as no patch links or vendor advisory details are provided.

The vulnerability allows a local attacker who already has System privileges to perform a local escalation of privilege via an out-of-bounds write caused by type confusion in the vdec component. This could potentially lead to increased control over the affected device. There is no indication of remote exploitation or user interaction requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or mitigation details are provided, users and administrators should monitor MediaTek advisories for updates and apply any official fixes once available.