CVE-2026-20502 · Severity: high · CVSS 8.4 · Published 2026-09-07
MediaTek's vdec video decoder component in certain smartphone and IoT chipsets contains a missing bounds check that allows an attacker with local access to write data outside allocated memory. This vulnerability can lead to privilege escalation, allowing attackers to gain elevated access to the device without needing special user permissions or interaction.
A patch was published on 2026-09-07: Patch ID ALPS11262030; Issue ID MSV-9196 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20502 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20502?
Check whether you run MediaTek Mt2718, MediaTek Mt2718 Firmware, MediaTek Mt6580 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an out-of-bounds write vulnerability in the vdec (video decoder) subcomponent caused by missing bounds validation. The vulnerability is triggered locally and allows memory corruption that can be leveraged for privilege escalation. No additional execution privileges or user interaction is required to exploit it. MediaTek has provided patches identified by Patch ID ALPS11262030 (Issue ID MSV-9196), and the company has confirmed no active in-the-wild exploitation at the time of disclosure.
Affected products
MediaTek MT2718
MediaTek MT6580
MediaTek MT6739
MediaTek MT6761
Timeline
2026-09-07: disclosed
2026-09-07: patched: Patch ID ALPS11262030; Issue ID MSV-9196