CVE-2026-20589: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability involves a type confusion issue in the venc component of MediaTek chipsets, leading to an out-of-bounds write condition. The flaw could be exploited by a local attacker who already possesses System privileges to escalate their privileges further. The affected chipsets include a broad range of MediaTek models such as MT2718, MT6768, MT6769, MT6789, MT6833, MT6855, MT6877, MT8186, MT8188, MT8189, MT8195, MT8196, MT8367, MT8391, MT8395, MT8668, MT8676, MT8678, MT8696, MT8781, MT8792, MT8793, MT8799, and MT8910. There is no indication of known exploits in the wild or a vendor advisory detailing patch availability.

The vulnerability could allow an attacker with existing System privileges to perform a local escalation of privilege via an out-of-bounds write caused by type confusion. This could lead to increased control over the affected device or chipset. However, exploitation requires prior System-level access, limiting the initial attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor advisory or patch link is provided, users should monitor MediaTek's official channels for updates and apply any forthcoming patches promptly. No specific mitigation steps are detailed in the available information.