CVE-2026-20489

Analyzed Analyzed - Analysis Complete

Integer Overflow in MediaTek Display Driver Leads to Information Disclosure

Publication date: 2026-08-03

Last updated on: 2026-08-19

Assigner: MediaTek, Inc.

Description

In display, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004274; Issue ID: MSV-7749.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-19

Generated

2026-08-23

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-20489

EUVD

EUVD-2026-52079

Affected Vendors & Products

Vendor	Product	Version / Range
mediatek	mt6991_firmware	*
mediatek	mt6993_firmware	*
mediatek	mt8126_firmware	*
mediatek	mt8171_firmware	*
mediatek	mt8188_firmware	*
mediatek	mt8189_firmware	*
mediatek	mt8367_firmware	*
mediatek	mt8668_firmware	*
mediatek	mt8676_firmware	*
mediatek	mt8678_firmware	*
mediatek	mt8766_firmware	*
mediatek	mt8768_firmware	*
mediatek	mt8781_firmware	*
mediatek	mt8786_firmware	*
mediatek	mt8791t_firmware	*
mediatek	mt8799_firmware	*
mediatek	mt8910_firmware	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the display component that could lead to local information disclosure. Exploitation requires the attacker to already have System privilege access. No user interaction is needed for this to occur.

Detection Guidance

Detection of this vulnerability requires checking for specific conditions related to the integer overflow in the display component. Since the issue is local and requires System privilege, commands should focus on identifying affected software versions or configurations. Review logs for unusual display-related errors or crashes. Check for patches or updates from the vendor (Patch ID: ALPS11004274).

Impact Analysis

If exploited, this vulnerability could allow an attacker with System privileges to disclose local information. This may include sensitive data stored or processed on the affected device.

Compliance Impact

This vulnerability could lead to local information disclosure if exploited by a malicious actor with System privileges. This may impact compliance with standards requiring data confidentiality, such as GDPR or HIPAA, by potentially exposing sensitive information.

Mitigation Strategies

Apply the patch identified as ALPS11004274 to address the integer overflow issue in the display component. Ensure the System privilege is properly restricted to prevent local information disclosure.

Hi! I’m here to help you understand CVE-2026-20489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70