CVE-2026-20412
Published: 02 February 2026
Summary
CVE-2026-20412 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Google Android. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through application of the vendor patch ALPS10351676 directly corrects the out-of-bounds write vulnerability in the cameraisp component.
Information input validation enforces bounds checks on inputs to the cameraisp component, directly preventing the out-of-bounds write due to missing bounds check.
Memory protection mechanisms such as non-executable memory and address space randomization mitigate exploitation of the out-of-bounds write for privilege escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables local arbitrary code execution for privilege escalation from obtained system-level access.
NVD Description
In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for…
more
exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5733.
Deeper analysisAI
CVE-2026-20412 is an out-of-bounds write vulnerability in the cameraisp component due to a missing bounds check. It affects MediaTek products, as detailed in their February 2026 product security bulletin, with associated Patch ID ALPS10351676 and Issue ID MSV-5733. The flaw is classified under CWE-787 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from local access.
The vulnerability enables local escalation of privilege for an attacker who has already obtained System privilege, with no user interaction required. Exploitation involves triggering the out-of-bounds write, allowing arbitrary code execution or further privilege elevation within the affected system.
MediaTek's February 2026 product security bulletin at https://corp.mediatek.com/product-security-bulletin/February-2026 provides details on the patch (ALPS10351676), recommending affected vendors apply it to mitigate the issue. Security practitioners should verify device firmware updates for inclusion of this fix.
Details
- CWE(s)