CVE-2026-20587: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in MediaTek, Inc. MediaTek chipset

This vulnerability involves a type confusion issue (CWE-843) in the MediaTek chipset's mtee component, which may lead to escalation of privilege locally. An attacker with existing System privileges could exploit this flaw to gain higher privileges. The vulnerability affects a broad range of MediaTek chipset models including MT2718, MT6768, MT6769, MT6789, MT6833, MT6855, MT6877, MT8186, MT8188, MT8189, MT8195, MT8196, MT8367, MT8391, MT8395, MT8668, MT8676, MT8678, MT8696, MT8781, MT8792, MT8793, MT8799, and MT8910. No CVSS score or detailed exploit information is provided. The patch ID ALPS11383899 is mentioned but no direct confirmation of patch availability is included.

Successful exploitation could allow a local attacker who already has System privileges to escalate their privileges further. This could lead to unauthorized access or control over sensitive system resources. No remote or user-interaction exploitation is required. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has assigned a patch ID (ALPS11383899), indicating a fix may exist or is in development. Until official confirmation, users should monitor MediaTek advisories for updates and apply patches once available.