CVE-2026-20471 MediaTek, Inc. CVE debrief

Who should care

Organizations with devices using Mediatek chipsets, especially those with physical access risks, should assess and prioritize patching for CVE-2026-20471. This includes reviewing device inventories, evaluating exposure, and implementing compensating controls where necessary. Security teams and vulnerability management teams should also review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

A possible out of bounds write due to a missing bounds check was reported in DA. This could lead to local denial of service if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch IDs: ALPS10991588 (for MT6880, MT6890, MT6990, MT6988, MT6986, MT6813) / AUTO00851171 (for MT2735, MT2737); Issue ID: MSV-7790. The affected products are those using Mediatek chipsets, particularly those with physical access risks.

Defensive priority

Medium priority for devices with physical access risks

Recommended defensive actions

• Inventory and assess devices for physical access risks
• Implement compensating controls for device access
• Monitor for and respond to potential local denial of service attempts
• Apply vendor remediation when available
• Review the official advisory and CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate a possible out of bounds write in DA due to a missing bounds check, leading to local denial of service. No additional execution privileges are needed for exploitation, but physical access to the device is required. User interaction is not needed. The official CVE record and NVD detail page provide additional context, but may not be comprehensive due to potential delays in updating. Defenders should verify affected scope, assess device exposure, and monitor for potential local denial of service attempts.

Official resources