CVE-2026-20529 - Vulnerability Details

In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11276677; Issue ID: MSV-9217.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Mediatek	Mt6761 Mt6761 Firmware Mt6765 Mt6765 Firmware Mt6768 Mt6768 Firmware Mt6781 Mt6781 Firmware Mt6853 Mt6853 Firmware Mt6858 Mt6858 Firmware Mt6881 Mt6881 Firmware Mt6893 Mt6893 Firmware Mt6989 Mt6989 Firmware Mt6991 Mt6991 Firmware Mt6993 Mt6993 Firmware Mt8171 Mt8171 Firmware Mt8186 Mt8186 Firmware Mt8188 Mt8188 Firmware Mt8189 Mt8189 Firmware Mt8196 Mt8196 Firmware Mt8766 Mt8766 Firmware Mt8768 Mt8768 Firmware Mt8775 Mt8775 Firmware Mt8781 Mt8781 Firmware Mt8788e Mt8788e Firmware Mt8791t Mt8791t Firmware Mt8792 Mt8792 Firmware Mt8796 Mt8796 Firmware Mt8799 Mt8799 Firmware Mt8883 Mt8883 Firmware Mt8893 Mt8893 Firmware Mt8910 Mt8910 Firmware
Mediatek, Inc.	Mediatek Chipset

Configuration 1 [-]

AND

cpe:2.3:o:mediatek:mt6761_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6761:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:mediatek:mt6765_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6765:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:mediatek:mt6768_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6768:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:mediatek:mt6781_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6781:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:mediatek:mt6853_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6853:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:mediatek:mt6858_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6858:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:mediatek:mt6881_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:mediatek:mt6893_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6893:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:mediatek:mt6989_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:mediatek:mt8186_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8186:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:mediatek:mt8196_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8196:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND

cpe:2.3:o:mediatek:mt8775_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8775:-:*:*:*:*:*:*:*

Configuration 20 [-]

AND

cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:*

Configuration 21 [-]

AND

cpe:2.3:o:mediatek:mt8788e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8788e:-:*:*:*:*:*:*:*

Configuration 22 [-]

AND

cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:*

Configuration 23 [-]

AND

cpe:2.3:o:mediatek:mt8792_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8792:-:*:*:*:*:*:*:*

Configuration 24 [-]

AND

cpe:2.3:o:mediatek:mt8796_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8796:-:*:*:*:*:*:*:*

Configuration 25 [-]

AND

cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:*

Configuration 26 [-]

AND

cpe:2.3:o:mediatek:mt8883_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8883:-:*:*:*:*:*:*:*

Configuration 27 [-]

AND

cpe:2.3:o:mediatek:mt8893_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8893:-:*:*:*:*:*:*:*

Configuration 28 [-]

AND

cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.mediatek.com/product-security-bulletin/October-2026

History

Fri, 09 Oct 2026 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mediatek Mediatek mt6761 Mediatek mt6761 Firmware Mediatek mt6765 Mediatek mt6765 Firmware Mediatek mt6768 Mediatek mt6768 Firmware Mediatek mt6781 Mediatek mt6781 Firmware Mediatek mt6853 Mediatek mt6853 Firmware Mediatek mt6858 Mediatek mt6858 Firmware Mediatek mt6881 Mediatek mt6881 Firmware Mediatek mt6893 Mediatek mt6893 Firmware Mediatek mt6989 Mediatek mt6989 Firmware Mediatek mt6991 Mediatek mt6991 Firmware Mediatek mt6993 Mediatek mt6993 Firmware Mediatek mt8171 Mediatek mt8171 Firmware Mediatek mt8186 Mediatek mt8186 Firmware Mediatek mt8188 Mediatek mt8188 Firmware Mediatek mt8189 Mediatek mt8189 Firmware Mediatek mt8196 Mediatek mt8196 Firmware Mediatek mt8766 Mediatek mt8766 Firmware Mediatek mt8768 Mediatek mt8768 Firmware Mediatek mt8775 Mediatek mt8775 Firmware Mediatek mt8781 Mediatek mt8781 Firmware Mediatek mt8788e Mediatek mt8788e Firmware Mediatek mt8791t Mediatek mt8791t Firmware Mediatek mt8792 Mediatek mt8792 Firmware Mediatek mt8796 Mediatek mt8796 Firmware Mediatek mt8799 Mediatek mt8799 Firmware Mediatek mt8883 Mediatek mt8883 Firmware Mediatek mt8893 Mediatek mt8893 Firmware Mediatek mt8910 Mediatek mt8910 Firmware
CPEs		cpe:2.3:h:mediatek:mt6761:-:::::::* cpe:2.3:h:mediatek:mt6765:-:::::::* cpe:2.3:h:mediatek:mt6768:-:::::::* cpe:2.3:h:mediatek:mt6781:-:::::::* cpe:2.3:h:mediatek:mt6853:-:::::::* cpe:2.3:h:mediatek:mt6858:-:::::::* cpe:2.3:h:mediatek:mt6881:-:::::::* cpe:2.3:h:mediatek:mt6893:-:::::::* cpe:2.3:h:mediatek:mt6989:-:::::::* cpe:2.3:h:mediatek:mt6991:-:::::::* cpe:2.3:h:mediatek:mt6993:-:::::::* cpe:2.3:h:mediatek:mt8171:-:::::::* cpe:2.3:h:mediatek:mt8186:-:::::::* cpe:2.3:h:mediatek:mt8188:-:::::::* cpe:2.3:h:mediatek:mt8189:-:::::::* cpe:2.3:h:mediatek:mt8196:-:::::::* cpe:2.3:h:mediatek:mt8766:-:::::::* cpe:2.3:h:mediatek:mt8768:-:::::::* cpe:2.3:h:mediatek:mt8775:-:::::::* cpe:2.3:h:mediatek:mt8781:-:::::::* cpe:2.3:h:mediatek:mt8788e:-:::::::* cpe:2.3:h:mediatek:mt8791t:-:::::::* cpe:2.3:h:mediatek:mt8792:-:::::::* cpe:2.3:h:mediatek:mt8796:-:::::::* cpe:2.3:h:mediatek:mt8799:-:::::::* cpe:2.3:h:mediatek:mt8883:-:::::::* cpe:2.3:h:mediatek:mt8893:-:::::::* cpe:2.3:h:mediatek:mt8910:-:::::::* cpe:2.3:o:mediatek:mt6761_firmware:-:::::::* cpe:2.3:o:mediatek:mt6765_firmware:-:::::::* cpe:2.3:o:mediatek:mt6768_firmware:-:::::::* cpe:2.3:o:mediatek:mt6781_firmware:-:::::::* cpe:2.3:o:mediatek:mt6853_firmware:-:::::::* cpe:2.3:o:mediatek:mt6858_firmware:-:::::::* cpe:2.3:o:mediatek:mt6881_firmware:-:::::::* cpe:2.3:o:mediatek:mt6893_firmware:-:::::::* cpe:2.3:o:mediatek:mt6989_firmware:-:::::::* cpe:2.3:o:mediatek:mt6991_firmware:-:::::::* cpe:2.3:o:mediatek:mt6993_firmware:-:::::::* cpe:2.3:o:mediatek:mt8171_firmware:-:::::::* cpe:2.3:o:mediatek:mt8186_firmware:-:::::::* cpe:2.3:o:mediatek:mt8188_firmware:-:::::::* cpe:2.3:o:mediatek:mt8189_firmware:-:::::::* cpe:2.3:o:mediatek:mt8196_firmware:-:::::::* cpe:2.3:o:mediatek:mt8766_firmware:-:::::::* cpe:2.3:o:mediatek:mt8768_firmware:-:::::::* cpe:2.3:o:mediatek:mt8775_firmware:-:::::::* cpe:2.3:o:mediatek:mt8781_firmware:-:::::::* cpe:2.3:o:mediatek:mt8788e_firmware:-:::::::* cpe:2.3:o:mediatek:mt8791t_firmware:-:::::::* cpe:2.3:o:mediatek:mt8792_firmware:-:::::::* cpe:2.3:o:mediatek:mt8796_firmware:-:::::::* cpe:2.3:o:mediatek:mt8799_firmware:-:::::::* cpe:2.3:o:mediatek:mt8883_firmware:-:::::::* cpe:2.3:o:mediatek:mt8893_firmware:-:::::::* cpe:2.3:o:mediatek:mt8910_firmware:-:::::::*
Vendors & Products		Mediatek Mediatek mt6761 Mediatek mt6761 Firmware Mediatek mt6765 Mediatek mt6765 Firmware Mediatek mt6768 Mediatek mt6768 Firmware Mediatek mt6781 Mediatek mt6781 Firmware Mediatek mt6853 Mediatek mt6853 Firmware Mediatek mt6858 Mediatek mt6858 Firmware Mediatek mt6881 Mediatek mt6881 Firmware Mediatek mt6893 Mediatek mt6893 Firmware Mediatek mt6989 Mediatek mt6989 Firmware Mediatek mt6991 Mediatek mt6991 Firmware Mediatek mt6993 Mediatek mt6993 Firmware Mediatek mt8171 Mediatek mt8171 Firmware Mediatek mt8186 Mediatek mt8186 Firmware Mediatek mt8188 Mediatek mt8188 Firmware Mediatek mt8189 Mediatek mt8189 Firmware Mediatek mt8196 Mediatek mt8196 Firmware Mediatek mt8766 Mediatek mt8766 Firmware Mediatek mt8768 Mediatek mt8768 Firmware Mediatek mt8775 Mediatek mt8775 Firmware Mediatek mt8781 Mediatek mt8781 Firmware Mediatek mt8788e Mediatek mt8788e Firmware Mediatek mt8791t Mediatek mt8791t Firmware Mediatek mt8792 Mediatek mt8792 Firmware Mediatek mt8796 Mediatek mt8796 Firmware Mediatek mt8799 Mediatek mt8799 Firmware Mediatek mt8883 Mediatek mt8883 Firmware Mediatek mt8893 Mediatek mt8893 Firmware Mediatek mt8910 Mediatek mt8910 Firmware

Mon, 05 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Title	Out‑of‑Bounds Write in MediaTek Battery Firmware Enables Local Privilege Escalation

Mon, 05 Oct 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 05 Oct 2026 08:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mediatek, Inc. Mediatek, Inc. mediatek Chipset
Vendors & Products		Mediatek, Inc. Mediatek, Inc. mediatek Chipset

Mon, 05 Oct 2026 03:45:00 +0000

Type	Values Removed	Values Added
Title		Out‑of‑Bounds Write in MediaTek Battery Firmware Enables Local Privilege Escalation

Mon, 05 Oct 2026 02:15:00 +0000

Type	Values Removed	Values Added
Description		In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11276677; Issue ID: MSV-9217.
Weaknesses		CWE-787
References		https://www.mediatek.com/product-security-bulletin/October-2026

MITRE

Status: PUBLISHED

Assigner: MediaTek

Published: 2026-10-05T01:40:05.493Z

Updated: 2026-10-06T03:55:46.657Z

Reserved: 2025-11-03T01:30:59.034Z

Link: CVE-2026-20529

Vulnrichment

Updated: 2026-10-05T10:29:49.204Z

NVD

Status : Analyzed

Published: 2026-10-05T02:16:51.640

Modified: 2026-10-09T15:02:40.510

Link: CVE-2026-20529

Redhat

No data.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object