Quick answers
- Is CVE-2026-20518 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20518 being exploited in the wild.
- How severe is CVE-2026-20518?
- Medium severity, with a CVSS score of 4.4, published 7 September 2026.
- Which products and versions are affected?
- MediaTek Geniezone.
- Is there a fix for CVE-2026-20518?
- A patch was published on 2026-09-07: Patches ALPS10867524 / ALPS10876355 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20518 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-20518?
- Check whether you run MediaTek GenieZone. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing bounds check in the Geniezone TEE that permits an out-of-bounds information disclosure. An attacker must already possess System privilege (a high-level precondition) and requires user interaction to trigger the exploit. The vulnerability allows unauthorized memory access and data exfiltration from protected memory regions. The missing bounds validation occurs at the input or buffer handling level, enabling reads beyond allocated memory. MediaTek has issued patches identified as ALPS10867524 and ALPS10876355 to remediate the issue.
Affected products
- MediaTek Geniezone
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Patches ALPS10867524 / ALPS10876355 released