CVE-2026-20471: MediaTek DA out-of-bounds write

CVE-2026-20471 · Severity: medium · CVSS 4.6 · Published 2026-08-03

MediaTek's DA (Display Architecture or similar component) contains a memory safety flaw that allows an attacker with physical access to trigger a denial-of-service condition by overwriting memory beyond intended bounds. While this requires device access, it can crash the affected component and disrupt device functionality without requiring elevated privileges or user interaction.

Technologies: MediaTek MT2735, MediaTek MT2737, MediaTek MT6813, MediaTek Mt6880, MediaTek Mt6890, MediaTek Mt6986, MediaTek MT6988, MediaTek MT6990. Vendors: MediaTek.

Quick answers

Is CVE-2026-20471 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20471 being exploited in the wild.
How severe is CVE-2026-20471?
Medium severity, with a CVSS score of 4.6, published 3 August 2026.
Which products and versions are affected?
MediaTek MT2735 as of August 2026; MediaTek MT2737 as of August 2026; MediaTek MT6813 as of August 2026; MediaTek Mt6880 as of August 2026; and 4 more.
Is there a fix for CVE-2026-20471?
A patch was published on 2026-08-03: Patches available via ALPS10991588 and AUTO00851171; notified to OEMs for at least two months prior Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20471 attacked?
It is attacked with physical access, in device firmware.
Am I affected by CVE-2026-20471?
Check whether you run MediaTek MT2735, MediaTek MT2737, MediaTek MT6813 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds write (CWE-787) caused by a missing bounds check in the DA subcomponent. An attacker with physical access to the device can exploit this flaw locally to cause a denial-of-service condition. The attack requires no elevated privileges and no user interaction. MediaTek has issued patches via ALPS10991588 (for MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) and AUTO00851171 (for MT2735, MT2737). The issue (MSV-7790) has been addressed in the August 2026 security bulletin and is not known to be exploited in the wild.

Affected products

  • MediaTek MT6880 as of August 2026
  • MediaTek MT6890 as of August 2026
  • MediaTek MT6990 as of August 2026
  • MediaTek MT6988 as of August 2026
  • MediaTek MT6986 as of August 2026
  • MediaTek MT6813 as of August 2026
  • MediaTek MT2735 as of August 2026
  • MediaTek MT2737 as of August 2026

Timeline

  • 2026-08-03: disclosed: Published in MediaTek August 2026 Product Security Bulletin
  • 2026-08-03: patched: Patches available via ALPS10991588 and AUTO00851171; notified to OEMs for at least two months prior

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.