# CVE-2026-20502: MediaTek vdec out of bounds write

Source: https://junglewise.ai/threats/cve-2026-20502-mediatek-vdec-out-of-bounds-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20502 · Severity: high · CVSS 8.4 · Published 2026-09-07

MediaTek's vdec video decoder component in certain smartphone and IoT chipsets contains a missing bounds check that allows an attacker with local access to write data outside allocated memory. This vulnerability can lead to privilege escalation, allowing attackers to gain elevated access to the device without needing special user permissions or interaction.

Technologies: [MediaTek Mt2718](https://junglewise.ai/threats/technologies/mt2718), [MediaTek Mt2718 Firmware](https://junglewise.ai/threats/technologies/mt2718-firmware), [MediaTek Mt6739](https://junglewise.ai/threats/technologies/mt6739), [MediaTek Mt6739 Firmware](https://junglewise.ai/threats/technologies/mt6739-firmware), [MediaTek Mt6761](https://junglewise.ai/threats/technologies/mt6761), [MediaTek Mt6761 Firmware](https://junglewise.ai/threats/technologies/mt6761-firmware), [MediaTek Mt6765](https://junglewise.ai/threats/technologies/mt6765), [MediaTek Mt6765 Firmware](https://junglewise.ai/threats/technologies/mt6765-firmware), [MediaTek Mt6768](https://junglewise.ai/threats/technologies/mt6768), [MediaTek Mt6768 Firmware](https://junglewise.ai/threats/technologies/mt6768-firmware), [MediaTek MT6769](https://junglewise.ai/threats/technologies/mt6769), [MediaTek Mt6769 Firmware](https://junglewise.ai/threats/technologies/mt6769-firmware), [MediaTek MT6779](https://junglewise.ai/threats/technologies/mt6779), [MediaTek Mt6779 Firmware](https://junglewise.ai/threats/technologies/mt6779-firmware), [MediaTek Mt6781](https://junglewise.ai/threats/technologies/mt6781), [MediaTek Mt6781 Firmware](https://junglewise.ai/threats/technologies/mt6781-firmware), [MediaTek MT6785](https://junglewise.ai/threats/technologies/mt6785), [MediaTek Mt6785 Firmware](https://junglewise.ai/threats/technologies/mt6785-firmware), [MediaTek Mt6789](https://junglewise.ai/threats/technologies/mt6789), [MediaTek Mt6789 Firmware](https://junglewise.ai/threats/technologies/mt6789-firmware), [MediaTek MT6833](https://junglewise.ai/threats/technologies/mt6833), [MediaTek Mt6833 Firmware](https://junglewise.ai/threats/technologies/mt6833-firmware), [MediaTek Mt6835](https://junglewise.ai/threats/technologies/mt6835), [MediaTek Mt6835 Firmware](https://junglewise.ai/threats/technologies/mt6835-firmware), [MediaTek Mt6853](https://junglewise.ai/threats/technologies/mt6853), [MediaTek Mt6853 Firmware](https://junglewise.ai/threats/technologies/mt6853-firmware), [MediaTek Mt6855](https://junglewise.ai/threats/technologies/mt6855), [MediaTek Mt6855 Firmware](https://junglewise.ai/threats/technologies/mt6855-firmware), [MediaTek MT6858](https://junglewise.ai/threats/technologies/mt6858), [MediaTek Mt6858 Firmware](https://junglewise.ai/threats/technologies/mt6858-firmware), [MediaTek MT6873](https://junglewise.ai/threats/technologies/mt6873), [MediaTek Mt6873 Firmware](https://junglewise.ai/threats/technologies/mt6873-firmware), [MediaTek Mt6877](https://junglewise.ai/threats/technologies/mt6877), [MediaTek Mt6877 Firmware](https://junglewise.ai/threats/technologies/mt6877-firmware), [MediaTek Mt6878](https://junglewise.ai/threats/technologies/mt6878), [MediaTek Mt6878 Firmware](https://junglewise.ai/threats/technologies/mt6878-firmware), [MediaTek Mt6879](https://junglewise.ai/threats/technologies/mt6879), [MediaTek Mt6879 Firmware](https://junglewise.ai/threats/technologies/mt6879-firmware), [MediaTek Mt6881](https://junglewise.ai/threats/technologies/mt6881), [MediaTek Mt6881 Firmware](https://junglewise.ai/threats/technologies/mt6881-firmware), [MediaTek Mt6883](https://junglewise.ai/threats/technologies/mt6883), [MediaTek Mt6883 Firmware](https://junglewise.ai/threats/technologies/mt6883-firmware), [MediaTek Mt6885](https://junglewise.ai/threats/technologies/mt6885), [MediaTek Mt6885 Firmware](https://junglewise.ai/threats/technologies/mt6885-firmware), [MediaTek Mt6886](https://junglewise.ai/threats/technologies/mt6886), [MediaTek Mt6886 Firmware](https://junglewise.ai/threats/technologies/mt6886-firmware), [MediaTek Mt6889](https://junglewise.ai/threats/technologies/mt6889), [MediaTek Mt6889 Firmware](https://junglewise.ai/threats/technologies/mt6889-firmware), [MediaTek Mt6893](https://junglewise.ai/threats/technologies/mt6893), [MediaTek Mt6893 Firmware](https://junglewise.ai/threats/technologies/mt6893-firmware), [MediaTek Mt6895](https://junglewise.ai/threats/technologies/mt6895), [MediaTek Mt6895 Firmware](https://junglewise.ai/threats/technologies/mt6895-firmware), [MediaTek Mt6897](https://junglewise.ai/threats/technologies/mt6897), [MediaTek Mt6897 Firmware](https://junglewise.ai/threats/technologies/mt6897-firmware), [MediaTek Mt6899](https://junglewise.ai/threats/technologies/mt6899), [MediaTek Mt6899 Firmware](https://junglewise.ai/threats/technologies/mt6899-firmware), [MediaTek Mt6983](https://junglewise.ai/threats/technologies/mt6983), [MediaTek Mt6983 Firmware](https://junglewise.ai/threats/technologies/mt6983-firmware), [MediaTek Mt6985](https://junglewise.ai/threats/technologies/mt6985), [MediaTek Mt6985 Firmware](https://junglewise.ai/threats/technologies/mt6985-firmware), [MediaTek Mt6989](https://junglewise.ai/threats/technologies/mt6989), [MediaTek Mt6989 Firmware](https://junglewise.ai/threats/technologies/mt6989-firmware), [MediaTek Mt6991](https://junglewise.ai/threats/technologies/mt6991), [MediaTek Mt6991 Firmware](https://junglewise.ai/threats/technologies/mt6991-firmware), [MediaTek MT6993](https://junglewise.ai/threats/technologies/mt6993), [MediaTek Mt6993 Firmware](https://junglewise.ai/threats/technologies/mt6993-firmware), [MediaTek Mt8126](https://junglewise.ai/threats/technologies/mt8126), [MediaTek Mt8126 Firmware](https://junglewise.ai/threats/technologies/mt8126-firmware), [MediaTek Mt8171](https://junglewise.ai/threats/technologies/mt8171), [MediaTek Mt8171 Firmware](https://junglewise.ai/threats/technologies/mt8171-firmware), [MediaTek Mt8186](https://junglewise.ai/threats/technologies/mt8186), [MediaTek Mt8186 Firmware](https://junglewise.ai/threats/technologies/mt8186-firmware), [MediaTek Mt8188](https://junglewise.ai/threats/technologies/mt8188), [MediaTek Mt8188 Firmware](https://junglewise.ai/threats/technologies/mt8188-firmware), [MediaTek Mt8189](https://junglewise.ai/threats/technologies/mt8189), [MediaTek Mt8189 Firmware](https://junglewise.ai/threats/technologies/mt8189-firmware), [MediaTek Mt8195](https://junglewise.ai/threats/technologies/mt8195), [MediaTek Mt8196](https://junglewise.ai/threats/technologies/mt8196), [MediaTek Mt8196 Firmware](https://junglewise.ai/threats/technologies/mt8196-firmware), [MediaTek Mt8367](https://junglewise.ai/threats/technologies/mt8367), [MediaTek Mt8367 Firmware](https://junglewise.ai/threats/technologies/mt8367-firmware), [MediaTek Mt8391](https://junglewise.ai/threats/technologies/mt8391), [MediaTek Mt8391 Firmware](https://junglewise.ai/threats/technologies/mt8391-firmware), [MediaTek Mt8395](https://junglewise.ai/threats/technologies/mt8395), [MediaTek Mt8395 Firmware](https://junglewise.ai/threats/technologies/mt8395-firmware), [MediaTek Mt8668](https://junglewise.ai/threats/technologies/mt8668), [MediaTek Mt8668 Firmware](https://junglewise.ai/threats/technologies/mt8668-firmware), [MediaTek MT8676](https://junglewise.ai/threats/technologies/mt8676), [MediaTek Mt8676 Firmware](https://junglewise.ai/threats/technologies/mt8676-firmware), [MediaTek MT8678](https://junglewise.ai/threats/technologies/mt8678), [MediaTek Mt8678 Firmware](https://junglewise.ai/threats/technologies/mt8678-firmware), [MediaTek MT8696](https://junglewise.ai/threats/technologies/mt8696), [MediaTek Mt8696 Firmware](https://junglewise.ai/threats/technologies/mt8696-firmware), [MediaTek Mt8781](https://junglewise.ai/threats/technologies/mt8781), [MediaTek Mt8781 Firmware](https://junglewise.ai/threats/technologies/mt8781-firmware), [MediaTek Mt8788e](https://junglewise.ai/threats/technologies/mt8788e), [MediaTek Mt8788e Firmware](https://junglewise.ai/threats/technologies/mt8788e-firmware), [MediaTek MT8792](https://junglewise.ai/threats/technologies/mt8792), [MediaTek Mt8792 Firmware](https://junglewise.ai/threats/technologies/mt8792-firmware), [MediaTek Mt8799](https://junglewise.ai/threats/technologies/mt8799), [MediaTek Mt8799 Firmware](https://junglewise.ai/threats/technologies/mt8799-firmware), [MediaTek Mt8910](https://junglewise.ai/threats/technologies/mt8910), [MediaTek Mt8910 Firmware](https://junglewise.ai/threats/technologies/mt8910-firmware). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek).

## Quick answers

**Is CVE-2026-20502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20502 being exploited in the wild.

**How severe is CVE-2026-20502?** High severity, with a CVSS score of 8.4, published 7 September 2026.

**Which products and versions are affected?** MediaTek MT2718; MediaTek MT6580; MediaTek MT6739; MediaTek MT6761.

**Is there a fix for CVE-2026-20502?** A patch was published on 2026-09-07: Patch ID ALPS11262030; Issue ID MSV-9196 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20502 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-20502?** Check whether you run MediaTek Mt2718, MediaTek Mt2718 Firmware, MediaTek Mt6580 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an out-of-bounds write vulnerability in the vdec (video decoder) subcomponent caused by missing bounds validation. The vulnerability is triggered locally and allows memory corruption that can be leveraged for privilege escalation. No additional execution privileges or user interaction is required to exploit it. MediaTek has provided patches identified by Patch ID ALPS11262030 (Issue ID MSV-9196), and the company has confirmed no active in-the-wild exploitation at the time of disclosure.

## Affected products

- MediaTek MT2718
- MediaTek MT6580
- MediaTek MT6739
- MediaTek MT6761

## Timeline

- 2026-09-07: disclosed
- 2026-09-07: patched: Patch ID ALPS11262030; Issue ID MSV-9196

## References

- [https://www.mediatek.com/product-security-bulletin/September-2026](https://www.mediatek.com/product-security-bulletin/September-2026)

## Related threats

- [MediaTek vdec out-of-bounds write in type confusion](https://junglewise.ai/threats/cve-2026-20579-in-vdec-there-is-a-possible-out-of-bounds-write-due-to-type)
- [MediaTek out of bounds write in modem](https://junglewise.ai/threats/cve-2026-20544-in-meta-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek Modem information disclosure due to logic error](https://junglewise.ai/threats/cve-2026-20543-in-modem-there-is-a-possible-information-disclosure-due-to-a)
- [MediaTek Modem out-of-bounds read due to missing permission check](https://junglewise.ai/threats/cve-2026-20538-in-modem-there-is-a-possible-out-of-bounds-read-due-to-a-missing)
- [MediaTek Modem out of bounds read](https://junglewise.ai/threats/cve-2026-20534-in-modem-there-is-a-possible-out-of-bounds-read-due-to-an)