Description
In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.
Published: 2026-11-02
Score: n/a
EPSS: n/a
KEV: No
Impact: Local privilege escalation
Action: Apply patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds write caused by a missing bounds check in the Data Acquisition component. An attacker who can physically access the device can exploit this flaw without any user interaction, potentially gaining elevated privileges on the system.

Affected Systems

The flaw affects MediaTek chipsets. No specific firmware or hardware revision is listed, but the supplied patch and issue identifiers apply to all current releases of the affected platform.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting it has not been widely exploited yet. However, because the attack vector requires only physical access and no additional privileges, the risk remains significant for environments where the device is not locked down. The advisory provides a patch (ALPS11468968, MSV-10166) that should be deployed promptly.

Generated by OpenCVE AI on November 2, 2026 at 03:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware with MediaTek patch ALPS11468968 (Issue ID MSV-10166).
  • If an immediate patch is not possible, restrict access to the Data Acquisition feature or disable the component to prevent exploitation.
  • Implement a physical security policy that limits unauthorized access to the device to reduce the attack surface.

Generated by OpenCVE AI on November 2, 2026 at 03:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 03:45:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write in MediaTek DA Allows Local Privilege Escalation

Mon, 02 Nov 2026 02:45:00 +0000

Type Values Removed Values Added
Description In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.
Weaknesses CWE-787
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: MediaTek

Published:

Updated: 2026-11-02T02:33:12.875Z

Reserved: 2025-11-03T01:30:59.042Z

Link: CVE-2026-20553

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T03:17:32.300

Modified: 2026-11-02T03:17:32.300

Link: CVE-2026-20553

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T03:30:06Z

Weaknesses