MediaTek chipset firmware: Out-of-bounds write in video decoder (vdec)
Summary
A missing bounds check in the vdec video decoder of certain MediaTek chipsets can lead to an out-of-bounds write. According to the CVE record, an attacker can escalate privileges remotely without additional execution privileges, but user interaction is required, for example by opening crafted media. The CVSS 3.1 base score is 8.8 (High).
Affected
- Per the official CNA record: MT6768, MT6769, MT6789, MT6833, MT6855, MT6877, MT8771, MT8781, MT8781X, MT8786, MT8791T (default: unaffected)
- The CPE data names MT8910, which is not in the CNA chipset list. Verify against the MediaTek bulletin before relying on it.
- Affected devices are mainly phones, tablets and MediaTek-based IoT or embedded devices.
Fixed in
Unknown. Patch ID ALPS11383899 and Issue ID MSV-9614 are referenced, but no fixed firmware build or security patch level per chipset has been confirmed. Obtain these from the device OEM.
Workaround
Unknown. No vendor-documented workaround was found. Restricting handling of untrusted media on managed devices may reduce exposure.
Exploitation
- MediaTek reports no known active exploitation at publication.
- Rapid7 lists the CVE as not in the CISA KEV catalogue; this was not verified on cisa.gov.
- No public proof of concept found.
- EPSS was 0% at the time of capture by Rapid7.
Our recommendation
- Inventory Android and MediaTek-based devices by chipset and model.
- Check each device's security patch level and install the device OEM update, enforced through MDM.
- Limit handling of untrusted media on managed devices where feasible.
- Treat devices that cannot be updated as residual risk and plan their replacement.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MediaTek October 2026 Product Security Bulletin www.mediatek.com
- Rapid7 vulnerability database entry CVE-2026-20586 www.rapid7.com
- CISA ADP Vulnrichment mirror CVE-2026-20586 hol.org
- Vulners CVE-2026-20586 vulners.com
- MediaTek product security acknowledgements www.mediatek.com
- Cyberpress: MediaTek fixes 31 chipset vulnerabilities cyberpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:35.
Original description (NVD)
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.