MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
64
Vulnerability3 · 1 read
CVE-2026-20522
Out-of-bounds write in MediaTek NeuroPilot allows local privilege escalation
- CVSS 3.1
- 8.4 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-20522 is an out-of-bounds write (CWE-787) in MediaTek NeuroPilot caused by a missing bounds check. A local attacker can trigger it without extra privileges and without user interaction, and the result is local escalation of privilege. NeuroPilot is MediaTek’s on-device AI component used on many of the company’s SoCs; the advisory names patch ALPS11249050 and issue MSV-9172 but does not list affected version ranges, and CVSS is not yet scored. It is not in CISA’s KEV catalog, and no public proof-of-concept is known.
What to do: Install the OEM/Android update that includes MediaTek patch ALPS11249050 (issue MSV-9172) as soon as the device maker ships it. Until then, treat this as a local privilege-escalation bug: avoid sideloading untrusted apps and keep the device on the latest available security update. No configuration workaround is described in the advisory.
| Product | Affected |
|---|---|
| MediaTek NeuroPilot | — |
Estimated exposure
massOrder of 100 million+ MediaTek devices that include NeuroPilot (exact vulnerable builds unknown) — NeuroPilot is MediaTek’s on-device AI stack shipped with many Helio and Dimensity SoCs in Android phones and other devices, and MediaTek’s smartphone chip shipments run to the hundreds of millions, so a flaw in that component plausibly…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249050; Issue ID: MSV-9172.
- Vendors
- mediatek
- Products
- mt6881 firmware, mt6993 firmware, mt8188 firmware, mt8189 firmware, mt8668 firmware, mt8781 firmware, mt8875 firmware, mt8910 firmware
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H