CVE-2026-20586: High severity MediaTek vdec vulnerability
Published Oct 5, 2026
·Updated
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614.
Affected Software
53 affected componentsFixes available
MediaTek vdec
All of the following
MediaTek Mt8910 Firmware
MediaTek Mt8910
All of the following
MediaTek Mt2718 Firmware
MediaTek Mt2718
All of the following
MediaTek Mt6768 Firmware
MediaTek Mt6768
All of the following
MediaTek Mt6789 Firmware
MediaTek Mt6789
All of the following
MediaTek Mt6769 Firmware
MediaTek Mt6769
All of the following
MediaTek Mt6833 Firmware
MediaTek Mt6833
All of the following
MediaTek Mt6855 Firmware
MediaTek Mt6855
All of the following
MediaTek Mt6877 Firmware
MediaTek Mt6877
All of the following
MediaTek Mt8186 Firmware
MediaTek Mt8186
All of the following
MediaTek Mt8188 Firmware
MediaTek Mt8188
All of the following
MediaTek Mt8189 Firmware
MediaTek Mt8189
All of the following
MediaTek Mt8195 Firmware
MediaTek Mt8195
All of the following
MediaTek Mt8196 Firmware
MediaTek Mt8196
All of the following
MediaTek Mt8367 Firmware
MediaTek Mt8367
All of the following
MediaTek Mt8391 Firmware
MediaTek Mt8391
All of the following
MediaTek Mt8395 Firmware
MediaTek Mt8395
All of the following
MediaTek Mt8668 Firmware
MediaTek Mt8668
All of the following
MediaTek Mt8676 Firmware
MediaTek Mt8676
All of the following
MediaTek Mt8678 Firmware
MediaTek Mt8678
All of the following
MediaTek Mt8696 Firmware
MediaTek Mt8696
All of the following
MediaTek Mt8781 Firmware
MediaTek Mt8781
All of the following
MediaTek Mt8788e Firmware
MediaTek Mt8788e
All of the following
MediaTek Mt8792 Firmware
MediaTek Mt8792
All of the following
MediaTek Mt8793 Firmware
MediaTek Mt8793
All of the following
MediaTek Mt8799 Firmware
MediaTek Mt8799
android/:unknown:>=SoCVersion:0<SoCVersion:2026-11-05
SoCVersion:2026-11-05
Google Android
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
android/:unknown:to a version that resolves this vulnerability.Fixed in SoCVersion:2026-11-05 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS11383899
Event History
Oct 5, 2026
CVE Published
via MITRE·01:39 AM
Data Sourced
via MITRE·01:39 AM
DescriptionWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeaknessAffected Software
Nov 1, 2026
Advisory Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionAffected Software
Nov 2, 2026
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Frequently Asked Questions
1
Does exploitation require the attacker to already have execution privileges on the target?
No additional execution privileges are needed for exploitation. However, user interaction is required.
2
What identifiers can be used to track the vendor fix?
The vendor patch identifier is ALPS11383899, and the associated issue identifier is MSV-9614.