CVE-2026-20587

Analyzed Analyzed - Analysis Complete

Type Confusion in mtee Leads to Privilege Escalation

Publication date: 2026-10-05

Last updated on: 2026-10-09

Assigner: MediaTek, Inc.

Description

In mtee, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9608.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-20587

EUVD

EUVD-2026-92198

Affected Vendors & Products

Vendor	Product	Version / Range
mediatek	mt2718_firmware	*
mediatek	mt6768_firmware	*
mediatek	mt6769_firmware	*
mediatek	mt6789_firmware	*
mediatek	mt6833_firmware	*
mediatek	mt6855_firmware	*
mediatek	mt6877_firmware	*
mediatek	mt8186_firmware	*
mediatek	mt8188_firmware	*
mediatek	mt8189_firmware	*
mediatek	mt8195_firmware	*
mediatek	mt8196_firmware	*
mediatek	mt8367_firmware	*
mediatek	mt8391_firmware	*
mediatek	mt8395_firmware	*
mediatek	mt8668_firmware	*
mediatek	mt8676_firmware	*
mediatek	mt8678_firmware	*
mediatek	mt8696_firmware	*
mediatek	mt8781_firmware	*
mediatek	mt8788e_firmware	*
mediatek	mt8792_firmware	*
mediatek	mt8793_firmware	*
mediatek	mt8799_firmware	*
mediatek	mt8910_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability in mtee is a type confusion issue that could allow an attacker to escalate privileges from System privilege to a higher level. It does not require user interaction to exploit.

Detection Guidance

Detection requires checking for the presence of the vulnerable mtee component and verifying if it has been updated. Inspect installed versions of mtee and compare against patched releases. No specific commands are provided in the context.

Impact Analysis

If an attacker already has System privilege on a device using mtee, they could exploit this to gain even higher privileges, potentially taking full control of the system.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves a local privilege escalation in mtee, which requires prior System privilege access. Without additional context on data handling or exposure, its compliance impact remains unclear.

Mitigation Strategies

Apply the patch identified as ALPS11383899 to address the type confusion issue in mtee. Ensure the System privilege is not granted to untrusted users to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-20587. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70