CVE-2026-20409
Published: 02 February 2026
Summary
CVE-2026-20409 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the missing bounds check vulnerability through timely identification, reporting, and application of patches like ALPS10363246.
Requires validation of inputs to the imgsys component to enforce bounds checking and prevent out-of-bounds writes.
Provides memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of out-of-bounds writes for privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local out-of-bounds write in imgsys enables privilege escalation from System-level access via memory corruption.
NVD Description
In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for…
more
exploitation. Patch ID: ALPS10363246; Issue ID: MSV-5779.
Deeper analysisAI
CVE-2026-20409, published on 2026-02-02, is a vulnerability in the imgsys component that enables an out-of-bounds write due to a missing bounds check (CWE-787). It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with Patch ID ALPS10363246 and Issue ID MSV-5779.
A local attacker who has already obtained System privilege can exploit this issue without user interaction to achieve escalation of privilege. Successful exploitation grants high-impact confidentiality, integrity, and availability effects.
The MediaTek Product Security Bulletin for February 2026 provides mitigation details, including the referenced patch, at https://corp.mediatek.com/product-security-bulletin/February-2026.
Details
- CWE(s)