Quick answers
- Is CVE-2026-20474 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20474 being exploited in the wild.
- How severe is CVE-2026-20474?
- Medium severity, with a CVSS score of 6, published 3 August 2026.
- Which products and versions are affected?
- MediaTek display driver <UNKNOWN>.
- Is there a fix for CVE-2026-20474?
- A patch was published on 2026-08-03: Patch ID: ALPS11019183 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20474 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-20474?
- Check whether you run MediaTek Mt6991, MediaTek Mt6991 Firmware, MediaTek MT6993 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a race condition in the display subsystem that leads to local privilege escalation. The vulnerability requires that an attacker has already obtained System privilege level access; no additional user interaction is needed for exploitation. The exact vulnerable component and root cause are not detailed in the available information, but the race condition allows privilege boundary bypass. A patch has been issued (Patch ID: ALPS11019183) by MediaTek and is available through their August 2026 security bulletin.
Affected products
- MediaTek display driver <UNKNOWN>
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Patch ID: ALPS11019183