CVE-2026-20474

Analyzed Analyzed - Analysis Complete

Privilege Escalation via Race Condition in MediaTek Display

Publication date: 2026-08-03

Last updated on: 2026-08-19

Assigner: MediaTek, Inc.

Description

In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-19

Generated

2026-08-23

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-20474

EUVD

EUVD-2026-52063

Affected Vendors & Products

Vendor	Product	Version / Range
mediatek	mt6991_firmware	*
mediatek	mt6993_firmware	*
mediatek	mt8126_firmware	*
mediatek	mt8171_firmware	*
mediatek	mt8188_firmware	*
mediatek	mt8189_firmware	*
mediatek	mt8367_firmware	*
mediatek	mt8668_firmware	*
mediatek	mt8676_firmware	*
mediatek	mt8678_firmware	*
mediatek	mt8766_firmware	*
mediatek	mt8768_firmware	*
mediatek	mt8781_firmware	*
mediatek	mt8786_firmware	*
mediatek	mt8791t_firmware	*
mediatek	mt8799_firmware	*
mediatek	mt8910_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the display component that could allow an attacker to escalate privileges from System privilege to a higher level. It does not require user interaction to exploit.

Detection Guidance

This vulnerability involves a race condition in the MediaTek display component that could allow privilege escalation. Detection may require checking for specific MediaTek display driver versions or logs indicating race condition errors. No specific commands are provided in the available context.

Impact Analysis

If an attacker already has System privilege access, they could exploit this to gain higher privileges, potentially leading to full control over the affected system.

Compliance Impact

This vulnerability involves a race condition leading to privilege escalation, which could allow unauthorized access if an attacker already has system privileges. This may impact compliance by potentially exposing sensitive data or system integrity, but specific effects on standards like GDPR or HIPAA depend on the system's configuration and data handling practices.

Mitigation Strategies

Apply the patch identified as ALPS11019183 to address the race condition in the display component. Ensure the System privilege is not granted to untrusted users to reduce exploitation risk.

Hi! I’m here to help you understand CVE-2026-20474. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70