CVE-2026-20586: High severity MediaTek vdec vulnerability

Published Oct 5, 2026

Updated

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614.

Affected Software

1 affected component

MediaTek vdec

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ALPS11383899

Event History

Oct 5, 2026

CVE Published

via MITRE·01:39 AM

Data Sourced

via MITRE·01:39 AM

DescriptionWeakness

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require the attacker to already have execution privileges on the target?

No additional execution privileges are needed for exploitation. However, user interaction is required.

What identifiers can be used to track the vendor fix?

The vendor patch identifier is ALPS11383899, and the associated issue identifier is MSV-9614.