CVE-2026-20582
Received Received - Intake

Memory Corruption in MediaTek USB Driver

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MediaTek, Inc.

Description
In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-20582

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory corruption vulnerability in the USB component of MediaTek chipsets. It occurs due to a double free issue, where memory is freed twice, potentially corrupting system memory. Exploitation requires the attacker to already have System privilege on the device.

Impact Analysis

If exploited, this vulnerability could allow an attacker with existing System privileges to escalate their access further, potentially gaining control over the device. This could lead to unauthorized data access, installation of malicious software, or other malicious activities.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves a memory corruption issue in USB components, potentially allowing local privilege escalation if an attacker already has system access.

Mitigation Strategies

Apply the patch identified as ALPS11411924 immediately to address the double free vulnerability in the USB component. Ensure the System privilege is not granted to untrusted users to prevent potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...