CVE-2026-20501 · Severity: high · CVSS 8.4 · Published 2026-09-07
MediaTek's vdec (video decoder) component in certain chipsets contains a heap buffer overflow vulnerability that allows local attackers to execute arbitrary code and escalate privileges without requiring user interaction or additional permissions. This could enable attackers with local access to gain full system control on affected devices including smartphones, tablets, and smart home products.
A patch was published on 2026-07-07: Patches distributed to OEMs at least two months before public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20501 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20501?
Check whether you run MediaTek Mt2718, MediaTek Mt2718 Firmware, MediaTek Mt6580 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a heap-based buffer overflow (CWE-122) in the vdec subcomponent that allows out-of-bounds memory writes. The flaw can be exploited locally without requiring elevated privileges or user interaction, making it suitable for local privilege escalation attacks. An attacker with local access to an affected device can trigger the vulnerability to overwrite heap memory, potentially achieving arbitrary code execution. MediaTek has issued patches (Patch ID: ALPS11262030) and distributed them to device OEMs at least two months prior to the public disclosure; no active exploitation in the wild has been reported as of the advisory date.
Affected products
MediaTek MT2718 <UNKNOWN>
MediaTek MT6580 <UNKNOWN>
MediaTek MT6739 <UNKNOWN>
MediaTek MT6761 <UNKNOWN>
Timeline
2026-09-07: disclosed
2026-07-07: patched: Patches distributed to OEMs at least two months before public disclosure