CVE-2026-20516

CVE-2026-20516 is a confused-deputy flaw in the MiracastService component of MediaTek device firmware that a local process running with user-level privileges can abuse to cause a denial of service. It is triggered by local execution on the device, requires no user interaction, and the CVSS vector indicates availability-only impact (high) with no confidentiality or integrity loss, despite the advisory describing it as a possible escalation of privilege. Affected devices are those running MediaTek firmware containing the vulnerable MiracastService component — the DTV patch identifier indicates MediaTek-powered digital TV/smart TV platforms are in scope. The affected firmware version range is not published in the available data. As of now the flaw is not in CISA KEV, EPSS is low (0.1% probability of exploitation in 30 days), one public proof-of-concept reference exists on GitHub, and no confirmed in-the-wild exploitation is reported.

What to do: Obtain firmware/OTA updates for MediaTek-based devices (especially smart TVs) from your device or TV vendor, looking for releases that incorporate MediaTek patch IDs ALPS11060069 / DTV04881615 or reference this CVE. Because exploitation requires local code execution with user privileges, avoid installing untrusted apps on affected TVs/devices as an interim mitigation. No network-level mitigation is indicated since the flaw is not remotely exploitable.