CVE-2026-20586: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability involves an out-of-bounds write in the MediaTek chipset's vdec component due to a missing bounds check. Successful exploitation can result in remote escalation of privilege, requiring user interaction but no additional execution privileges. The issue affects a broad range of MediaTek chipset versions, including MT2718, MT6768, MT6769, MT6789, MT6833, MT6855, MT6877, MT8186, MT8188, MT8189, MT8195, MT8196, MT8367, MT8391, MT8395, MT8668, MT8676, MT8678, MT8696, MT8781, MT8792, MT8793, MT8799, and MT8910. The vulnerability is tracked under Patch ID ALPS11383899 and Issue ID MSV-9614. No patch or remediation details are provided in the input data.

The vulnerability allows remote escalation of privilege on affected MediaTek chipsets via an out-of-bounds write in the video decoder. Exploitation requires user interaction but no additional execution privileges. This could potentially allow an attacker to gain higher privileges remotely, impacting device security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users and administrators should monitor MediaTek advisories for updates and apply patches once available.