CVE-2026-20417: 
NixOS vulnerability analysis and mitigation

CVE-2026-20417 is an out-of-bounds write vulnerability in the PCIe driver component of MediaTek chipsets (MT6991, MT6993, MT8678) affecting devices running Android 15.0 and 16.0. The flaw stems from a missing bounds check in the PCIe subsystem and could allow a local attacker who has already obtained System-level privileges to escalate privileges further. It was published on February 2, 2026, with patches released in MediaTek's February 2026 Product Security Bulletin. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (MediaTek Bulletin, Red Hat CVE).

The root cause is classified as CWE-787 (Out-of-bounds Write): the PCIe driver fails to validate input boundaries before writing to memory, enabling arbitrary memory writes. Exploitation requires local access with at least System-level privileges already obtained — no user interaction is needed. The attack vector is local with low attack complexity, and the scope remains unchanged. Patch IDs ALPS10314946 and ALPS10340155 address the missing bounds check (Issue ID: MSV-5154) (MediaTek Bulletin).

Successful exploitation allows a local attacker already holding System privileges to perform arbitrary memory writes, potentially escalating to higher privilege levels on the affected device. The vulnerability has limited but concrete impacts across confidentiality, integrity, and availability (each rated Low in the CVSS assessment). Affected chipsets (MT6991, MT6993, MT8678) are used in Android 15.0 and 16.0 devices, meaning a broad range of MediaTek-powered handsets and tablets could be at risk if an attacker has already achieved System-level access (MediaTek Bulletin).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation is further constrained by the prerequisite of System-level privilege on the target device (MediaTek Bulletin).

MediaTek has released patches (ALPS10314946 / ALPS10340155) addressing this vulnerability, published in the February 2026 MediaTek Product Security Bulletin. Device manufacturers (OEMs) should integrate and distribute these patches to affected devices running Android 15.0 and 16.0 with MT6991, MT6993, or MT8678 chipsets. As a defense-in-depth measure, organizations should restrict System-level privilege access and monitor for anomalous privilege escalation activity on managed Android devices (MediaTek Bulletin).