Is CVE-2026-20530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20530 being exploited in the wild.

How severe is CVE-2026-20530?

Medium severity, with a CVSS score of 6.7, published 5 October 2026.

Is there a fix for CVE-2026-20530?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20530 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-20530?

Check whether you run MediaTek MT2716 Chipset, MediaTek MT2735 chipset, MediaTek MT2737 chipset or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20530: MediaTek display out-of-bounds write privilege escalation

CVE-2026-20530 · Severity: medium · CVSS 6.7 · Published 2026-10-05

A flaw in MediaTek chipset display components allows an attacker who already has system-level privileges to write data beyond allocated memory boundaries, potentially leading to further privilege escalation or system compromise. The vulnerability requires no user interaction and affects multiple smartphone and device chipsets.

Technologies: MediaTek MT2716 Chipset, MediaTek MT2735 chipset, MediaTek MT2737 chipset, MediaTek MT6835 Chipset, MediaTek MT6858 Chipset, MediaTek MT6878 Chipset, MediaTek MT6880 chipset, MediaTek MT6881 Chipset, MediaTek MT6890 chipset. Vendors: MediaTek.

Quick answers

Is CVE-2026-20530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20530 being exploited in the wild.
How severe is CVE-2026-20530?: Medium severity, with a CVSS score of 6.7, published 5 October 2026.
Which products and versions are affected?: MediaTek MT2716 chipset; MediaTek MT2735 chipset; MediaTek MT2737 chipset; MediaTek MT6813 chipset; and 22 more.
Is there a fix for CVE-2026-20530?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20530 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20530?: Check whether you run MediaTek MT2716 Chipset, MediaTek MT2735 chipset, MediaTek MT2737 chipset or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the display component due to missing bounds checking. The vulnerability requires the attacker to already possess system privilege, making it a local privilege escalation path. No user interaction is needed for exploitation.

Affected products

MediaTek MT2716 chipset
MediaTek MT2735 chipset
MediaTek MT2737 chipset
MediaTek MT6813 chipset
MediaTek MT6815 chipset
MediaTek MT6833 chipset
MediaTek MT6835 chipset
MediaTek MT6853 chipset
MediaTek MT6855 chipset
MediaTek MT6858 chipset
MediaTek MT6873 chipset
MediaTek MT6875 chipset
MediaTek MT6877 chipset
MediaTek MT6878 chipset
MediaTek MT6879 chipset
MediaTek MT6880 chipset
MediaTek MT6881 chipset
MediaTek MT6883 chipset
MediaTek MT6885 chipset
MediaTek MT6886 chipset
MediaTek MT6889 chipset
MediaTek MT6890 chipset
MediaTek MT6891 chipset
MediaTek MT6893 chipset
MediaTek MT6895 chipset
MediaTek MT6896 chipset

Timeline

2026-10-05: disclosed

References

https://www.mediatek.com/product-security-bulletin/October-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.