CVE-2026-20584
Received Received - Intake

Memory Corruption in MediaTek USB Driver

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MediaTek, Inc.

Description
In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-20584

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a missing bounds check in the USB component of MediaTek chipsets, which could lead to memory corruption. Exploitation requires the attacker to already have System privilege and could result in local privilege escalation. No user interaction is needed for this attack.

Detection Guidance

Detection requires checking for unpatched MediaTek USB drivers or firmware. Since exploitation requires System privilege, focus on verifying driver versions and kernel modules. Check MediaTek's patch ID ALPS11411916 or issue MSV-9746 for updates.

Impact Analysis

If exploited, this vulnerability could allow an attacker with System privileges to escalate their privileges further, potentially gaining full control over the device. This could lead to unauthorized access, data theft, or installation of malicious software.

Compliance Impact

The vulnerability allows local privilege escalation due to memory corruption in USB components. This could potentially enable unauthorized access to sensitive data if exploited, which may impact compliance with data protection regulations like GDPR or HIPAA by increasing the risk of data breaches.

Mitigation Strategies

Apply the patch provided by MediaTek (Patch ID: ALPS11411916) to address the missing bounds check in the USB component. Ensure the patch is deployed across all affected MediaTek chipsets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20584. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...