CVE-2026-20588: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability (CVE-2026-20588) involves an out-of-bounds write (CWE-787) in the mtee component of MediaTek chipsets due to a missing bounds check. The flaw enables a local escalation of privilege if the attacker has already obtained System privileges. Exploitation does not require user interaction. The affected chipsets include a broad range of MediaTek models such as MT2718, MT6768, MT6769, MT6789, MT6833, MT6855, MT6877, MT8186, MT8188, MT8189, MT8195, MT8196, MT8367, MT8391, MT8395, MT8668, MT8676, MT8678, MT8696, MT8781, MT8792, MT8793, MT8799, and MT8910. The vendor has assigned Patch ID ALPS11383899 and Issue ID MSV-9607, but no patch links or official remediation details are provided in the input data.

The vulnerability allows a local attacker with System privileges to escalate their privileges further via an out-of-bounds write, potentially compromising system integrity or security. Since the attacker must already have System privileges, the impact is limited to privilege escalation rather than initial system compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has assigned a patch ID (ALPS11383899), indicating a fix may exist or is in progress. Until an official patch is confirmed and applied, restrict local access to trusted users only to reduce risk.