CVE-2026-20516

Deferred Deferred - Pending Action

Privilege Escalation in MiracastService

Publication date: 2026-09-07

Last updated on: 2026-09-22

Assigner: MediaTek, Inc.

Description

In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11060069 / DTV04881615; Issue ID: MSV-7882.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-22

Generated

2026-09-27

AI Q&A

2026-09-07

EPSS Evaluated

2026-09-26

NVD

CVE-2026-20516

EUVD

EUVD-2026-72198

Affected Vendors & Products

Vendor	Product	Version / Range
mediatek	miracastservice	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-926	The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

Executive Summary

This vulnerability in MiracastService allows a local attacker to escalate privileges due to a confused deputy issue. It could result in a denial of service attack with only user execution privileges required. No user interaction is needed for exploitation.

Detection Guidance

Detection of CVE-2026-20516 requires checking for vulnerable versions of MiracastService on MediaTek devices. Since this is a local privilege escalation issue, commands would focus on identifying the service version or related logs. Use 'adb shell dumpsys package | grep MiracastService' to check service details or 'adb logcat | grep MSV-7882' to search for related error logs. Ensure the device has MediaTek's patch ALPS11060069 or DTV04881615 applied.

Impact Analysis

An attacker could exploit this to cause a local denial of service on your device. Since user execution privileges are sufficient, it may affect devices using MiracastService without requiring additional user actions.

Compliance Impact

This vulnerability does not provide specific information about compliance impacts on standards like GDPR or HIPAA. The issue involves a local denial of service with user execution privileges, which may not directly relate to data protection or privacy regulations.

Mitigation Strategies

Apply the provided patch (ALPS11060069 / DTV04881615) to address the confused deputy issue in MiracastService. Ensure the patch is installed to prevent local denial of service with User execution privileges.

Hi! I’m here to help you understand CVE-2026-20516. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70