# CVE-2026-20474: MediaTek display driver privilege escalation via race condition

Source: https://junglewise.ai/threats/cve-2026-20474-mediatek-display-driver-privilege-escalation-via-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20474 · Severity: medium · CVSS 6 · Published 2026-08-03

A race condition vulnerability exists in MediaTek chipset display drivers that allows privilege escalation. An attacker who already holds System-level privileges can exploit this to elevate privileges further, with no user interaction required. This could be leveraged as part of a multi-stage attack to gain complete control of affected devices.

Technologies: [MediaTek Mt6991](https://junglewise.ai/threats/technologies/mt6991), [MediaTek Mt6991 Firmware](https://junglewise.ai/threats/technologies/mt6991-firmware), [MediaTek MT6993](https://junglewise.ai/threats/technologies/mt6993), [MediaTek Mt6993 Firmware](https://junglewise.ai/threats/technologies/mt6993-firmware), [MediaTek Mt8126](https://junglewise.ai/threats/technologies/mt8126), [MediaTek Mt8126 Firmware](https://junglewise.ai/threats/technologies/mt8126-firmware), [MediaTek Mt8171](https://junglewise.ai/threats/technologies/mt8171), [MediaTek Mt8171 Firmware](https://junglewise.ai/threats/technologies/mt8171-firmware), [MediaTek Mt8188](https://junglewise.ai/threats/technologies/mt8188), [MediaTek Mt8188 Firmware](https://junglewise.ai/threats/technologies/mt8188-firmware), [MediaTek Mt8189](https://junglewise.ai/threats/technologies/mt8189), [MediaTek Mt8189 Firmware](https://junglewise.ai/threats/technologies/mt8189-firmware), [MediaTek Mt8367](https://junglewise.ai/threats/technologies/mt8367), [MediaTek Mt8367 Firmware](https://junglewise.ai/threats/technologies/mt8367-firmware), [MediaTek Mt8668](https://junglewise.ai/threats/technologies/mt8668), [MediaTek Mt8668 Firmware](https://junglewise.ai/threats/technologies/mt8668-firmware), [MediaTek MT8676](https://junglewise.ai/threats/technologies/mt8676), [MediaTek Mt8676 Firmware](https://junglewise.ai/threats/technologies/mt8676-firmware), [MediaTek MT8678](https://junglewise.ai/threats/technologies/mt8678), [MediaTek Mt8678 Firmware](https://junglewise.ai/threats/technologies/mt8678-firmware), [MediaTek Mt8766](https://junglewise.ai/threats/technologies/mt8766), [MediaTek Mt8766 Firmware](https://junglewise.ai/threats/technologies/mt8766-firmware), [MediaTek Mt8768](https://junglewise.ai/threats/technologies/mt8768), [MediaTek Mt8768 Firmware](https://junglewise.ai/threats/technologies/mt8768-firmware), [MediaTek Mt8781](https://junglewise.ai/threats/technologies/mt8781), [MediaTek Mt8781 Firmware](https://junglewise.ai/threats/technologies/mt8781-firmware), [MediaTek Mt8786](https://junglewise.ai/threats/technologies/mt8786), [MediaTek Mt8786 Firmware](https://junglewise.ai/threats/technologies/mt8786-firmware), [MediaTek Mt8791t](https://junglewise.ai/threats/technologies/mt8791t), [MediaTek Mt8791t Firmware](https://junglewise.ai/threats/technologies/mt8791t-firmware), [MediaTek Mt8799](https://junglewise.ai/threats/technologies/mt8799), [MediaTek Mt8799 Firmware](https://junglewise.ai/threats/technologies/mt8799-firmware), [MediaTek Mt8910](https://junglewise.ai/threats/technologies/mt8910), [MediaTek Mt8910 Firmware](https://junglewise.ai/threats/technologies/mt8910-firmware). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek).

## Quick answers

**Is CVE-2026-20474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20474 being exploited in the wild.

**How severe is CVE-2026-20474?** Medium severity, with a CVSS score of 6, published 3 August 2026.

**Which products and versions are affected?** MediaTek display driver <UNKNOWN>.

**Is there a fix for CVE-2026-20474?** A patch was published on 2026-08-03: Patch ID: ALPS11019183 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20474 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-20474?** Check whether you run MediaTek Mt6991, MediaTek Mt6991 Firmware, MediaTek MT6993 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a race condition in the display subsystem that leads to local privilege escalation. The vulnerability requires that an attacker has already obtained System privilege level access; no additional user interaction is needed for exploitation. The exact vulnerable component and root cause are not detailed in the available information, but the race condition allows privilege boundary bypass. A patch has been issued (Patch ID: ALPS11019183) by MediaTek and is available through their August 2026 security bulletin.

## Affected products

- MediaTek display driver <UNKNOWN>

## Timeline

- 2026-08-03: disclosed
- 2026-08-03: patched: Patch ID: ALPS11019183

## References

- [https://www.mediatek.com/product-security-bulletin/August-2026](https://www.mediatek.com/product-security-bulletin/August-2026)

## Related threats

- [MediaTek GPU use after free leading to system crash](https://junglewise.ai/threats/cve-2026-20515-mediatek-gpu-use-after-free-leading-to-system-crash)
- [MediaTek Modem denial of service due to missing bounds check](https://junglewise.ai/threats/cve-2026-20504-mediatek-modem-denial-of-service-due-to-missing-bounds-check)
- [MediaTek Modem system crash due to missing bounds check](https://junglewise.ai/threats/cve-2026-20503-mediatek-modem-system-crash-due-to-missing-bounds-check)
- [MediaTek vdec out of bounds write](https://junglewise.ai/threats/cve-2026-20502-mediatek-vdec-out-of-bounds-write)
- [MediaTek vdec heap buffer overflow privilege escalation](https://junglewise.ai/threats/cve-2026-20501-mediatek-vdec-heap-buffer-overflow-privilege-escalation)