MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
64
CVE-2026-20523
Out-of-bounds write privilege escalation in MediaTek NeuroPilot
- CVSS 3.1
- 8.4 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-20523 is an out-of-bounds write (CWE-787) in MediaTek NeuroPilot caused by a missing bounds check. A local attacker can trigger it without extra execution privileges and without user interaction, and the result is local privilege escalation. MediaTek assigned patch ID ALPS11249062 and issue ID MSV-9171; the public description does not list chipsets or version ranges. It is one of a broader set of MediaTek fixes covering modem, video, and AI components. It is not on the CISA KEV list, CVSS is not yet scored, and no public proof-of-concept is known.
What to do: Apply the vendor firmware or BSP update that includes MediaTek patch ALPS11249062 (issue MSV-9171) as soon as your device OEM ships it, and confirm the build notes mention this CVE or that patch ID. Until then, treat untrusted local apps as a risk on devices that include NeuroPilot, because the flaw needs no extra privileges and no user interaction. No public exploit is known; there is no version range in the advisory to pin a narrower workaround to.
| Product | Affected |
|---|---|
| MediaTek NeuroPilot | — |
Estimated exposure
massOrder of magnitude: tens to hundreds of millions of MediaTek devices that include NeuroPilot (estimate only; exact affected builds unknown) — The advisory names NeuroPilot but no chipset or version counts; the estimate uses MediaTek’s position as a mass-market mobile SoC supplier whose on-device AI stack (NeuroPilot) ships on a large share of Android phones and related devices.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249062; Issue ID: MSV-9171.
- Vendors
- mediatek
- Products
- mt6881 firmware, mt6993 firmware, mt8188 firmware, mt8189 firmware, mt8668 firmware, mt8781 firmware, mt8793 firmware, mt8875 firmware, mt8910 firmware
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H