CVE-2026-20491: MediaTek Chipset Local DoS Vulnerability

CVE-2026-20491 Overview

CVE-2026-20491 is an out-of-bounds write vulnerability in the MediaTek med component caused by an incorrect bounds check [CWE-787]. A local attacker with low privileges can trigger the flaw to cause a denial of service on affected MediaTek chipsets. User interaction is not required for exploitation.

MediaTek addressed the issue in its August 2026 Product Security Bulletin. The fix is tracked as Patch ID ALPS10981478 for MT6890, MT6990, and MT6988, and AUTO00851173 for MT2735 and MT2737. The internal issue ID is MSV-7652.

Critical Impact
A local, low-privileged process can write outside allocated bounds in the med component, resulting in high availability impact through denial of service on affected MediaTek chipsets.

Affected Products

MediaTek MT6890, MT6990, MT6988 chipsets (Patch ID ALPS10981478)
MediaTek MT2735, MT2737 chipsets (Patch ID AUTO00851173)
Devices integrating the MediaTek med component on the affected chipsets

Discovery Timeline

2026-08-03 - CVE-2026-20491 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-20491

Vulnerability Analysis

The flaw resides in the MediaTek med component. An incorrect bounds check permits a write operation to exceed the boundary of an allocated buffer. This condition is classified as [CWE-787] Out-of-Bounds Write.

Exploitation requires local access and low privileges on the device. No user interaction is needed. Successful triggering corrupts adjacent memory and destabilizes the component, producing a denial of service. The advisory does not indicate confidentiality or integrity impact, and no code execution primitive is described.

The EPSS probability is 0.102%, reflecting a low predicted likelihood of exploitation in the wild. MediaTek has not reported active exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is an incorrect bounds check preceding a write operation inside the med component. When input sizes or offsets are validated improperly, the code path writes past the intended memory region. This class of defect frequently occurs when signed and unsigned integer comparisons or length calculations diverge from actual buffer sizes.

Attack Vector

The attack vector is local. An attacker must already execute code on the device with user-level privileges, for example through a malicious installed application. The attacker then issues a crafted request to the med component, whose faulty bounds check allows the out-of-bounds write and crashes the service. See the MediaTek Security Bulletin August 2026 for technical details.

// No verified exploit code is publicly available for CVE-2026-20491.
// Refer to the MediaTek Product Security Bulletin (August 2026) for advisory details.

Detection Methods for CVE-2026-20491

Indicators of Compromise

Repeated crashes or restarts of the MediaTek med component or associated services on affected chipsets
Kernel or system logs referencing faults, segmentation errors, or aborts originating from med
Untrusted applications repeatedly interacting with vendor-specific med interfaces prior to service failure

Detection Strategies

Monitor device telemetry for abnormal termination of the med service on MT6890, MT6990, MT6988, MT2735, and MT2737 platforms
Correlate application install events with subsequent crash signatures in the med component
Track patch level compliance against MediaTek Patch IDs ALPS10981478 and AUTO00851173

Monitoring Recommendations

Ingest mobile and automotive device logs into a centralized analytics platform to identify crash clusters tied to the med component
Alert on installation of untrusted applications on devices that have not yet received the August 2026 MediaTek patch
Baseline normal med service behavior and flag deviations in restart frequency and error codes

How to Mitigate CVE-2026-20491

Immediate Actions Required

Apply the vendor firmware update containing MediaTek Patch ID ALPS10981478 (MT6890, MT6990, MT6988) or AUTO00851173 (MT2735, MT2737)
Inventory devices using the affected chipsets and confirm patch status through OEM channels
Restrict installation of untrusted applications on unpatched devices to reduce local attack surface

Patch Information

MediaTek published the fix in the MediaTek Security Bulletin August 2026. Device manufacturers must integrate the patch into their firmware images before end users can install it. Contact the OEM if updates are not yet delivered over the air.

Workarounds

Limit local access on affected devices by enforcing application allowlists where supported
Disable or constrain interfaces exposing the med component to third-party applications where the platform permits
Prioritize patch rollout on production and safety-critical automotive deployments using MT2735 and MT2737

bash

# Example: verify patch level on an Android device (adjust for OEM)
adb shell getprop ro.build.version.security_patch
adb shell getprop ro.vendor.mediatek.version.release