CVE-2026-20572

View on CVE.org
Published Nov 2, 2026 CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Description
In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Out‑of‑Bounds Write via Integer Overflow in MediaTek ADSP Enables Local Privilege Escalation
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mediatek
Mediatek mediatek Chipset
Mediatek, Inc.
Mediatek, Inc. mediatek Chipset
Vendors & Products Mediatek
Mediatek mediatek Chipset
Mediatek, Inc.
Mediatek, Inc. mediatek Chipset
Type Values Removed Values Added
Title Out‑of‑Bounds Write via Integer Overflow in MediaTek ADSP Enables Local Privilege Escalation
Type Values Removed Values Added
Description In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.
Weaknesses CWE-191
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
MediaTek
Published
Updated
Nov 3, 2026, 4:55 AM
Reserved
Nov 3, 2025, 1:30 AM

View source JSON

Updated
Nov 2, 2026, 3:04 PM

JSON

Status
Awaiting Analysis
Published
Nov 2, 2026, 3:17 AM
Modified
Nov 3, 2026, 5:18 AM

View source JSON

No data.

Updated
Nov 2, 2026, 6:00 PM

JSON