CVE-2026-20523: MediaTek Neuropilot vulnerability

Published Oct 5, 2026

Updated

In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249062; Issue ID: MSV-9171.

Affected Software

1 affected component

MediaTek Neuropilot

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade neuropilot to a version that resolves this vulnerability.
Patch ALPS11249062

Event History

Oct 5, 2026

CVE Published

via MITRE·01:39 AM

Data Sourced

via MITRE·01:39 AM

DescriptionWeakness

Data Sourced

via NVD·02:16 AM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Exploitation requires local access. No additional execution privileges are needed, and no user interaction is required.

What remediation identifier should teams use when tracking a fix?

The listed patch ID is ALPS11249062. The associated issue ID is MSV-9171.