CVE-2026-20478: Buffer Overflow
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS10981454 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch AUTO00851293
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20478?
The severity of CVE-2026-20478 is classified as medium with a CVSS score of 5.5.
How do I fix CVE-2026-20478?
To fix CVE-2026-20478, apply the patch identified as ALPS10981454 or AUTO00851293 depending on your device.
What type of vulnerability is CVE-2026-20478?
CVE-2026-20478 is classified as a buffer overflow vulnerability that can lead to a local denial of service.
Who is affected by CVE-2026-20478?
Devices utilizing Audio HAL, particularly those using MediaTek chipsets like MT6880, MT6890, MT6988, and MT6990, are affected by CVE-2026-20478.
Does CVE-2026-20478 require user interaction for exploitation?
No, CVE-2026-20478 does not require user interaction for exploitation.