CVE-2026-20586

CVE-2026-20586 is an out-of-bounds write (CWE-787) in MediaTek's vdec video decoder caused by a missing bounds check. An attacker can trigger it remotely by getting a user to process malicious video content; no additional execution privileges are required, but user interaction is needed. Successful exploitation can escalate privileges on the device. It affects products that include the vulnerable MediaTek vdec component; the public record cites patch ALPS11383899 and issue MSV-9614 but does not list chipsets or version ranges, and CVSS is not yet scored. It is not in CISA's KEV catalog, and no public proof-of-concept is known.

What to do: Install the OEM or Android update that includes MediaTek patch ALPS11383899 (issue MSV-9614) as soon as your device vendor ships it. Until then, avoid opening video files or streams from untrusted sources, because exploitation requires user interaction. Confirm coverage in your vendor's security bulletin rather than assuming every MediaTek chipset is affected.