MediaTek Video HAL: Local privilege escalation via missing bounds check
Summary
A missing bounds check in the Video HAL component of certain MediaTek chipsets allows a local attacker to escalate privileges. The CNA record states that no additional execution privileges and no user interaction are required. An attacker first needs a local foothold on the device, for example through a malicious or compromised app, before the escalation step can be used.
Affected
- MediaTek chipsets listed in the CNA record: MT2718, MT6768, MT6769, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893
- Third-party mirrors list a longer and partly different chipset list; the MediaTek bulletin is the reference.
- Firmware or software version numbers: Unknown.
Fixed in
- Patch ID ALPS11375674 (Issue ID MSV-9571), delivered via MediaTek October 2026 bulletin.
- Fixed OEM firmware builds: Unknown. Check with the device manufacturer.
Workaround
- None documented. Install the vendor-supplied OEM update.
Exploitation
- MediaTek is not aware of active exploitation in the wild.
- Not listed in CISA KEV at time of research.
- No public proof-of-concept found.
Our recommendation
- Inventory devices with MediaTek chipsets, especially Android phones and tablets.
- Verify the OEM security patch level and install the October 2026 update or later.
- Enforce updates through MDM and monitor for OEM patch releases.
- Restrict installation of untrusted apps to reduce the chance of a local foothold.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MediaTek October 2026 Product Security Bulletin www.mediatek.com
- GBHackers: MediaTek fixes 31 security flaws gbhackers.com
- CISA ADP Vulnrichment summary (HOL) hol.org
- Strix CVE-2026-20521 www.strix.ai
- SecurityOnline: MediaTek October 2026 bulletin securityonline.info
- BreachRoad: MediaTek October 2026 managed device updates breachroad.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:55.
Original description (NVD)
In Video HAL, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11375674; Issue ID: MSV-9571.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.