Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2026-20501

In vdec, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11262030; Issue ID: MSV-9197.

Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 8.4, requiring local system access to exploit with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 106 products from mediatek, from mediatek, from mediatek and 103 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2026, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2026-09-07T02:17:18.800

Last Modified

2026-09-09T02:55:16.850

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.4 (HIGH)

Weaknesses

Type: Secondary
CWE-122

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	mediatek	mt2718_firmware	-	Yes
Hardware	mediatek	mt2718	-	No
Operating System	mediatek	mt6580_firmware	-	Yes
Hardware	mediatek	mt6580	-	No
Operating System	mediatek	mt6739_firmware	-	Yes
Hardware	mediatek	mt6739	-	No
Operating System	mediatek	mt6761_firmware	-	Yes
Hardware	mediatek	mt6761	-	No
Operating System	mediatek	mt6765_firmware	-	Yes
Hardware	mediatek	mt6765	-	No
Operating System	mediatek	mt6768_firmware	-	Yes
Hardware	mediatek	mt6768	-	No
Operating System	mediatek	mt6769_firmware	-	Yes
Hardware	mediatek	mt6769	-	No
Operating System	mediatek	mt6779_firmware	-	Yes
Hardware	mediatek	mt6779	-	No
Operating System	mediatek	mt6781_firmware	-	Yes
Hardware	mediatek	mt6781	-	No
Operating System	mediatek	mt6785_firmware	-	Yes
Hardware	mediatek	mt6785	-	No
Operating System	mediatek	mt6789_firmware	-	Yes
Hardware	mediatek	mt6789	-	No
Operating System	mediatek	mt6833_firmware	-	Yes
Hardware	mediatek	mt6833	-	No
Operating System	mediatek	mt6835_firmware	-	Yes
Hardware	mediatek	mt6835	-	No
Operating System	mediatek	mt6853_firmware	-	Yes
Hardware	mediatek	mt6853	-	No
Operating System	mediatek	mt6855_firmware	-	Yes
Hardware	mediatek	mt6855	-	No
Operating System	mediatek	mt6858_firmware	-	Yes
Hardware	mediatek	mt6858	-	No
Operating System	mediatek	mt6873_firmware	-	Yes
Hardware	mediatek	mt6873	-	No
Operating System	mediatek	mt6877_firmware	-	Yes
Hardware	mediatek	mt6877	-	No
Operating System	mediatek	mt6878_firmware	-	Yes
Hardware	mediatek	mt6878	-	No
Operating System	mediatek	mt6879_firmware	-	Yes
Hardware	mediatek	mt6879	-	No
Operating System	mediatek	mt6881_firmware	-	Yes
Hardware	mediatek	mt6881	-	No
Operating System	mediatek	mt6883_firmware	-	Yes
Hardware	mediatek	mt6883	-	No
Operating System	mediatek	mt6885_firmware	-	Yes
Hardware	mediatek	mt6885	-	No
Operating System	mediatek	mt6886_firmware	-	Yes
Hardware	mediatek	mt6886	-	No
Operating System	mediatek	mt6889_firmware	-	Yes
Hardware	mediatek	mt6889	-	No
Operating System	mediatek	mt6893_firmware	-	Yes
Hardware	mediatek	mt6893	-	No
Operating System	mediatek	mt6895_firmware	-	Yes
Hardware	mediatek	mt6895	-	No
Operating System	mediatek	mt6897_firmware	-	Yes
Hardware	mediatek	mt6897	-	No
Operating System	mediatek	mt6899_firmware	-	Yes
Hardware	mediatek	mt6899	-	No
Operating System	mediatek	mt6983_firmware	-	Yes
Hardware	mediatek	mt6983	-	No
Operating System	mediatek	mt6985_firmware	-	Yes
Hardware	mediatek	mt6985	-	No
Operating System	mediatek	mt6989_firmware	-	Yes
Hardware	mediatek	mt6989	-	No
Operating System	mediatek	mt6991_firmware	-	Yes
Hardware	mediatek	mt6991	-	No
Operating System	mediatek	mt6993_firmware	-	Yes
Hardware	mediatek	mt6993	-	No
Operating System	mediatek	mt8126_firmware	-	Yes
Hardware	mediatek	mt8126	-	No
Operating System	mediatek	mt8171_firmware	-	Yes
Hardware	mediatek	mt8171	-	No
Operating System	mediatek	mt8186_firmware	-	Yes
Hardware	mediatek	mt8186	-	No
Operating System	mediatek	mt8188_firmware	-	Yes
Hardware	mediatek	mt8188	-	No
Operating System	mediatek	mt8189_firmware	-	Yes
Hardware	mediatek	mt8189	-	No
Operating System	mediatek	mt8195_firmware	-	Yes
Hardware	mediatek	mt8195	-	No
Operating System	mediatek	mt8196_firmware	-	Yes
Hardware	mediatek	mt8196	-	No
Operating System	mediatek	mt8367_firmware	-	Yes
Hardware	mediatek	mt8367	-	No
Operating System	mediatek	mt8391_firmware	-	Yes
Hardware	mediatek	mt8391	-	No
Operating System	mediatek	mt8395_firmware	-	Yes
Hardware	mediatek	mt8395	-	No
Operating System	mediatek	mt8668_firmware	-	Yes
Hardware	mediatek	mt8668	-	No
Operating System	mediatek	mt8676_firmware	-	Yes
Hardware	mediatek	mt8676	-	No
Operating System	mediatek	mt8678_firmware	-	Yes
Hardware	mediatek	mt8678	-	No
Operating System	mediatek	mt8696_firmware	-	Yes
Hardware	mediatek	mt8696	-	No
Operating System	mediatek	mt8781_firmware	-	Yes
Hardware	mediatek	mt8781	-	No
Operating System	mediatek	mt8788e_firmware	-	Yes
Hardware	mediatek	mt8788e	-	No
Operating System	mediatek	mt8792_firmware	-	Yes
Hardware	mediatek	mt8792	-	No
Operating System	mediatek	mt8799_firmware	-	Yes
Hardware	mediatek	mt8799	-	No
Operating System	mediatek	mt8910_firmware	-	Yes
Hardware	mediatek	mt8910	-	No

References

https://www.mediatek.com/product-security-bulletin/September-2026 Vendor Advisory ([email protected])

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For mediatek's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.