Junglewise Threat Intelligence
CVE-2026-20501: MediaTek vdec heap buffer overflow privilege escalation
CVE-2026-20501 · Severity: high · CVSS 8.4 · Published 2026-09-07
Technologies: MediaTek Mt6881 Firmware, MediaTek Mt6878 Firmware, MediaTek Mt8367, MediaTek Mt8126 Firmware, MediaTek Mt6895 Firmware, MediaTek Mt8367 Firmware, MediaTek Mt6879, MediaTek Mt6768 Firmware, MediaTek Mt6885, MediaTek Mt6873 Firmware, MediaTek Mt6989 Firmware, MediaTek Mt6886, MediaTek MT8676, MediaTek MT6785, MediaTek Mt8188 Firmware, MediaTek Mt6835 Firmware, MediaTek Mt6855 Firmware, MediaTek Mt6883, MediaTek Mt8391, MediaTek Mt6993 Firmware, MediaTek Mt6789 Firmware, MediaTek Mt8910 Firmware, MediaTek Mt6878, MediaTek Mt6765, MediaTek Mt6991, MediaTek Mt8395, MediaTek Mt6879 Firmware, MediaTek Mt2718 Firmware, MediaTek Mt8696 Firmware, MediaTek MT6993, MediaTek Mt2718, MediaTek Mt6855, MediaTek Mt6877 Firmware, MediaTek Mt8676 Firmware, MediaTek Mt6897, MediaTek Mt6789, MediaTek Mt6761, MediaTek Mt8126, MediaTek Mt6877, MediaTek Mt6985 Firmware, MediaTek MT8792, MediaTek Mt6897 Firmware, MediaTek Mt6833 Firmware, MediaTek Mt6853 Firmware, MediaTek Mt6835, MediaTek Mt6889, MediaTek Mt8668, MediaTek Mt6853, MediaTek Mt8799, MediaTek Mt8188, MediaTek Mt6886 Firmware, MediaTek Mt6983 Firmware, MediaTek Mt6881, MediaTek Mt8189, MediaTek Mt6761 Firmware, MediaTek Mt6991 Firmware, MediaTek MT6858, MediaTek Mt8910, MediaTek Mt6765 Firmware, MediaTek MT8696, MediaTek Mt6899, MediaTek Mt6889 Firmware, MediaTek Mt8792 Firmware, MediaTek Mt8781, MediaTek Mt8391 Firmware, MediaTek Mt6858 Firmware, MediaTek Mt8189 Firmware, MediaTek MT6833, MediaTek Mt8678 Firmware, MediaTek Mt8395 Firmware, MediaTek Mt6899 Firmware, MediaTek Mt6895, MediaTek Mt6781 Firmware, MediaTek Mt6739 Firmware, MediaTek Mt6739, MediaTek Mt8668 Firmware, MediaTek Mt6985, MediaTek Mt8781 Firmware, MediaTek Mt8171, MediaTek Mt6989, MediaTek Mt6893 Firmware, MediaTek Mt6781, MediaTek Mt8799 Firmware, MediaTek MT6779, MediaTek MT6769, MediaTek MT8678, MediaTek Mt6768, MediaTek Mt6893, MediaTek Mt6883 Firmware, MediaTek MT6873, MediaTek Mt6983, MediaTek Mt6885 Firmware, MediaTek Mt8171 Firmware. Vendors: MediaTek.
Executive brief
MediaTek's vdec (video decoder) component in certain chipsets contains a heap buffer overflow vulnerability that allows local attackers to execute arbitrary code and escalate privileges without requiring user interaction or additional permissions. This could enable attackers with local access to gain full system control on affected devices including smartphones, tablets, and smart home products.
Technical details
The vulnerability is a heap-based buffer overflow (CWE-122) in the vdec subcomponent that allows out-of-bounds memory writes. The flaw can be exploited locally without requiring elevated privileges or user interaction, making it suitable for local privilege escalation attacks. An attacker with local access to an affected device can trigger the vulnerability to overwrite heap memory, potentially achieving arbitrary code execution. MediaTek has issued patches (Patch ID: ALPS11262030) and distributed them to device OEMs at least two months prior to the public disclosure; no active exploitation in the wild has been reported as of the advisory date.
Affected products
- MediaTek MT2718 <UNKNOWN>
- MediaTek MT6580 <UNKNOWN>
- MediaTek MT6739 <UNKNOWN>
- MediaTek MT6761 <UNKNOWN>
Timeline
- 2026-09-07: disclosed
- 2026-07-07: patched: Patches distributed to OEMs at least two months before public disclosure