{"id":"CVE-2026-20595","aliases":[],"cve":{"records":[{"id":"CVE-2026-20595","source":"MediaTek","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2025-11-03T01:30:59.050Z","published":"2026-11-02T02:34:12.308Z","modified":"2026-11-03T04:55:38.893Z"}],"publishers":[{"name":"MediaTek","role":"CNA","organizationId":"ee979b05-11f8-4f25-a7e0-a1fa9c190374","modified":"2026-11-02T02:34:12.308Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-03T04:55:38.893Z"}],"references":[{"url":"https://www.mediatek.com/product-security-bulletin/November-2026","tags":[],"source":"MediaTek"}],"weaknesses":[{"id":"CWE-1286","description":"CWE-1286 Improper Validation of Syntactic Correctness of Input","source":"MediaTek"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-02T00:00:00+00:00","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"In neuropilot, there is a possible out of bounds write due to a missing bounds check.","titleSource":"MediaTek","descriptionSource":"MediaTek","description":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.","score":6.7,"severity":"medium","published":"2026-11-02T02:34:12.308Z","modified":"2026-11-03T04:55:38.893Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"MediaTek, Inc.","name":"MediaTek chipset","platforms":[],"versions":[{"version":"MT6739","status":"affected"},{"version":"MT6761","status":"affected"},{"version":"MT6765","status":"affected"},{"version":"MT6768","status":"affected"},{"version":"MT6781","status":"affected"},{"version":"MT6789","status":"affected"},{"version":"MT6833","status":"affected"},{"version":"MT6835","status":"affected"},{"version":"MT6853","status":"affected"},{"version":"MT6855","status":"affected"},{"version":"MT6858","status":"affected"},{"version":"MT6877","status":"affected"},{"version":"MT6878","status":"affected"},{"version":"MT6879","status":"affected"},{"version":"MT6883","status":"affected"},{"version":"MT6885","status":"affected"},{"version":"MT6886","status":"affected"},{"version":"MT6889","status":"affected"},{"version":"MT6893","status":"affected"},{"version":"MT6895","status":"affected"},{"version":"MT6897","status":"affected"},{"version":"MT6899","status":"affected"},{"version":"MT6983","status":"affected"},{"version":"MT6985","status":"affected"},{"version":"MT6989","status":"affected"},{"version":"MT6991","status":"affected"},{"version":"MT6993","status":"affected"},{"version":"MT8168","status":"affected"},{"version":"MT8188","status":"affected"},{"version":"MT8189","status":"affected"},{"version":"MT8321","status":"affected"},{"version":"MT8385","status":"affected"},{"version":"MT8696","status":"affected"},{"version":"MT8765","status":"affected"},{"version":"MT8766","status":"affected"},{"version":"MT8768","status":"affected"},{"version":"MT8771","status":"affected"},{"version":"MT8781","status":"affected"},{"version":"MT8786","status":"affected"},{"version":"MT8788","status":"affected"},{"version":"MT8791T","status":"affected"},{"version":"MT8793","status":"affected"},{"version":"MT8797","status":"affected"},{"version":"MT8798","status":"affected"},{"version":"MT8875","status":"affected"},{"version":"MT8910","status":"affected"},{"version":"MT8911","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"MediaTek","url":"https://www.cve.org/CVERecord?id=CVE-2026-20595"}],"remediation":[],"references":["https://www.mediatek.com/product-security-bulletin/November-2026"],"sources":[{"name":"CVE","id":"CVE-2026-20595","modified":"2026-11-03T04:55:38.893Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-20595"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":6.7}],"sourceAffected":[],"observedAt":"2026-11-03T05:10:04.208Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:00:33.565Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-02T02:55:38.072Z","attemptedAt":"2026-11-02T02:55:38.072Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-02T02:55:38.268Z","attemptedAt":"2026-11-02T02:55:38.268Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-02T02:55:39.192Z","attemptedAt":"2026-11-02T02:55:39.192Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-02T02:55:37.816Z","attemptedAt":"2026-11-02T02:55:37.816Z"}],"evidence":[],"aiSummary":{"text":"MediaTek neuropilot has a possible out of bounds write due to a missing bounds check, which could lead to local escalation of privilege if a malicious actor has System privilege. Affected versions include MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8188, MT8189, MT8321, MT8385, MT8696, MT8765, MT8766, MT8768, MT8771, MT8781, MT8786, MT8788, MT8791T, MT8793, MT8797, MT8798, MT8875, MT8910, MT8911. User interaction is not needed for exploitation.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-02T02:46:46.614Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-20595"}]}}