# CVE-2026-20518: MediaTek Geniezone information disclosure via missing bounds check

Source: https://junglewise.ai/threats/cve-2026-20518-mediatek-geniezone-information-disclosure-via-missing-bounds  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20518 · Severity: medium · CVSS 4.4 · Published 2026-09-07

MediaTek Geniezone is a trusted execution environment (TEE) security processor embedded in MediaTek chipsets used in Android smartphones and IoT devices. An attacker who already has System-level privileges can exploit a missing bounds check to read sensitive data from protected memory, requiring user interaction to succeed. This vulnerability could expose confidential information such as cryptographic keys, authentication tokens, or user data that should remain isolated.

Technologies: [MediaTek GenieZone](https://junglewise.ai/threats/technologies/geniezone). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek).

## Quick answers

**Is CVE-2026-20518 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20518 being exploited in the wild.

**How severe is CVE-2026-20518?** Medium severity, with a CVSS score of 4.4, published 7 September 2026.

**Which products and versions are affected?** MediaTek Geniezone.

**Is there a fix for CVE-2026-20518?** A patch was published on 2026-09-07: Patches ALPS10867524 / ALPS10876355 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20518 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-20518?** Check whether you run MediaTek GenieZone. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing bounds check in the Geniezone TEE that permits an out-of-bounds information disclosure. An attacker must already possess System privilege (a high-level precondition) and requires user interaction to trigger the exploit. The vulnerability allows unauthorized memory access and data exfiltration from protected memory regions. The missing bounds validation occurs at the input or buffer handling level, enabling reads beyond allocated memory. MediaTek has issued patches identified as ALPS10867524 and ALPS10876355 to remediate the issue.

## Affected products

- MediaTek Geniezone

## Timeline

- 2026-09-07: disclosed
- 2026-09-07: patched: Patches ALPS10867524 / ALPS10876355 released

## References

- [https://www.mediatek.com/product-security-bulletin/September-2026](https://www.mediatek.com/product-security-bulletin/September-2026)

## Related threats

- [MediaTek geniezone use-after-free privilege escalation](https://junglewise.ai/threats/cve-2026-20517-mediatek-geniezone-use-after-free-privilege-escalation)
- [MediaTek geniezone out-of-bounds write](https://junglewise.ai/threats/cve-2026-20481-mediatek-geniezone-out-of-bounds-write)
- [MediaTek GenieZone out-of-bounds write privilege escalation](https://junglewise.ai/threats/cve-2026-20455-mediatek-geniezone-out-of-bounds-write-privilege-escalation)
- [MediaTek GenieZone out of bounds write via race condition](https://junglewise.ai/threats/cve-2026-20454-mediatek-geniezone-out-of-bounds-write-via-race-condition)
- [MediaTek GenieZone out-of-bounds write privilege escalation](https://junglewise.ai/threats/cve-2026-20453-mediatek-geniezone-out-of-bounds-write-privilege-escalation)