CVE-2026-20412: 
NixOS vulnerability analysis and mitigation

CVE-2026-20412 is an out-of-bounds write vulnerability in the MediaTek cameraisp component that can enable local escalation of privilege on affected Android devices. It affects multiple MediaTek chipsets (MT6878, MT6879, MT6881, MT6886, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8188, MT8195, MT8365, MT8390, MT8395, MT8666, MT8667, MT8673, MT8676, MT8696, MT8793) running Android 13.0, 14.0, 15.0, and 16.0. The vulnerability was published on February 2, 2026, with a patch released in MediaTek's February 2026 Product Security Bulletin (Patch ID: ALPS10351676; Issue ID: MSV-5733). It carries a CVSS v3.1 base score of 7.8 (High) (MediaTek Advisory).

The root cause is a missing bounds check in the cameraisp kernel driver component, classified as CWE-787 (Out-of-bounds Write). An attacker who has already obtained System-level privilege on the device can trigger the out-of-bounds write to further escalate privileges, potentially gaining higher kernel-level access. The attack vector is local, requires low privileges, has low attack complexity, and does not require user interaction (MediaTek Advisory).

Successful exploitation allows a System-privileged attacker to escalate privileges further on the affected device, with high impact to confidentiality, integrity, and availability. An attacker could leverage this vulnerability to access sensitive data, modify system state, or cause denial of service at a level beyond their initial System privilege. The scope is limited to the affected device (unchanged scope), but the full CIA triad is compromised (MediaTek Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have already obtained System privilege on the target device, which significantly limits the attack surface (MediaTek Advisory).

MediaTek has released a patch addressing this vulnerability, identified as Patch ID ALPS10351676 (Issue ID: MSV-5733), included in the February 2026 MediaTek Product Security Bulletin. Users and device manufacturers should apply OTA updates incorporating this patch for Android 13.0, 14.0, 15.0, and 16.0 on affected chipsets. No specific workaround is documented; upgrading to a patched firmware version is the recommended remediation (MediaTek Advisory).

Coverage of CVE-2026-20412 has been limited to automated vulnerability tracking platforms and aggregators such as Vulners, VulDB, and CVEFeed, with no notable independent researcher commentary or significant media coverage identified. The Hacker Wire published a brief mention of the vulnerability shortly after disclosure (MediaTek Advisory).