CVE-2026-20528: MediaTek CCCI vulnerability
In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS11428950 (Note: For MT6880, MT6890) / ALPS10563453 (Note: For MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988) / AUTO00858766 (Note: For MT2735, MT2737); Issue ID: MSV-9893.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS11428950 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS10563453 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch AUTO00858766
Event History
Frequently Asked Questions
Who is realistically able to exploit this issue?
Exploitation requires an attacker to have already obtained System privilege and requires user interaction. It is therefore a post-compromise issue rather than an initial access vector.
What impact could successful exploitation have?
A successful exploit could cause local information disclosure, memory corruption, crashes, or privilege escalation through out-of-bounds reads and writes.
Which platforms have identified patch IDs?
ALPS11428950 applies to MT6880 and MT6890. ALPS10563453 applies to MT6980D, MT6990, MT6986, MT6986D, MT6813, and MT6988; AUTO00858766 applies to MT2735 and MT2737.