Time-of-check time-of-use race condition in MediaTek chipset
Priority LOW 28CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00128 2nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MediaTek | MediaTek chipset | MT6991; MT6993; MT8126; MT8171; MT8188; MT8189; MT8367; MT8668; MT8676; MT8678; MT8766; MT8768; MT8781; MT8786; MT8791T; MT8799; MT8910 | — | No fix listed | CNA |
- MediaTek chipset VendorMediaTek Affected MT6991; MT6993; MT8126; MT8171; MT8188; MT8189; MT8367; MT8668; MT8676; MT8678; MT8766; MT8768; MT8781; MT8786; MT8791T; MT8799; MT8910 Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8126_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8126:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt6991_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt6993_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8126_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8126:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8171_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8171:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8188_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
| cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MediaTek |
| cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MediaTek |
- cpe:2.3:o:mediatek:mt8189_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8189:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8367_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8367:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8668_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8668:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8676_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8678_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8678:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8766_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8766:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8768_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8768:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8781_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8781:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8786_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8786:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8791t_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8791t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8799_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8799:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
- cpe:2.3:o:mediatek:mt8910_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MediaTek
- cpe:2.3:h:mediatek:mt8910:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MediaTek
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-20474
- 2026-10-03 Alias added: GHSA-mx2w-3qf4-9ffq
References
More MediaTek Mt6991 Firmware vulnerabilities
- TI-2026-16576 Out-of-bounds write in MediaTek chipset CVSS 3.1HIGH 8.8
- TI-2026-16643 Heap-based buffer overflow in MediaTek chipset CVSS 3.1HIGH 8.4
- TI-2026-16642 Heap-based buffer overflow in MediaTek chipset CVSS 3.1HIGH 8.4
- TI-2026-67566 Privilege escalation in MediaTek Video HAL from missing bounds check CVSS 3.1HIGH 8.4
- TI-2026-16575 Out-of-bounds write in MediaTek chipset CVSS 3.1HIGH 8.0
- TI-2026-16626 Missing authorization in MediaTek chipset CVSS 3.1HIGH 7.7
Sources
- CVE-2026-20474 · CVE Program
- CVE-2026-20474 · NVD
- FIRST EPSS
- GHSA-mx2w-3qf4-9ffq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences