CVE-2026-20501

CVE-2026-20501 is a heap-based buffer overflow (CWE-122) in the vdec (video decoder) component of firmware for a wide range of MediaTek chipsets, which can cause an out-of-bounds write when crafted data is processed by the decoder. A local attacker with no additional execution privileges — for example a low-privileged app or process on the device — could exploit it without any user interaction to gain elevated privileges. Affected devices are those running firmware for the listed MediaTek SoCs (MT2718, MT6580, MT6739, MT6761, MT6765, MT6768, MT6769, MT6779, MT6781, MT6785, MT6789 and MT6833), chips commonly found in budget Android smartphones, feature phones, smart TVs and other consumer/IoT hardware. There is no evidence of active exploitation: the flaw is not in CISA KEV, has an EPSS 30-day probability of about 0.1% (3rd percentile), and no public proof-of-concept is known. The fix ships via MediaTek/OEM firmware updates associated with Patch ID ALPS11262030 (Issue ID MSV-9197).

What to do: Apply the fixed firmware containing MediaTek patch ALPS11262030 (Issue MSV-9197) as soon as your device OEM or carrier ships it, and check your device's chipset against the affected list in vendor security bulletins. Because exploitation requires local code execution, the practical risk before patching is limited to attackers who can already run an app or process on the device, so avoid installing untrusted apps on affected devices. Organizations managing fleets of MediaTek-based phones, TVs or IoT hardware should prioritize OEM update rollouts for the listed SoCs.