CVE-2026-20464 Integer overflow in MediaTek chipset
An integer overflow in the MediaTek HEVC decoder allows remote privilege escalation for attackers with System privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-20464?
CVE-2026-20464 is a medium-severity vulnerability in MediaTek, Inc. MediaTek chipset, published on 3 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In hevc decoder, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11104718; Issue ID: MSV-8297.
Weakness: CWE-787
Which versions are affected by CVE-2026-20464?
How do I fix CVE-2026-20464?
Apply the vendor's patch.
Is CVE-2026-20464 being exploited?
There is no known exploitation of CVE-2026-20464 in the wild and no public exploit code.
Sources
Also known as A-518566453, ASB-A-518566453, GHSA-mg45-crjv-3qfx, M-ALPS11104718.