CVE-2026-20528

Executive Summary

CVE-2026-20528 is a memory-safety vulnerability in MediaTek's ccci (Cross-Core Communication Interface) driver, caused by a missing bounds check that permits out-of-bounds write and read operations. Affected systems are mobile and automotive platforms running MediaTek chipsets MT6880, MT6890, MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988 (mobile), and MT2735, MT2737 (automotive). Successful exploitation by an actor who has already obtained System privilege combined with user interaction may result in local information disclosure, memory corruption, denial of service (crash), or privilege escalation, elevating impact into kernel/TrustZone-adjacent execution contexts.

Technical Analysis

The vulnerability resides in the ccci subsystem — MediaTek's cross-core communication interface that mediates data exchange between the application processor (AP) and the baseband/modem processor (BP), as well as related inter-processor channels used across the SoC. The NVD description states the flaw is "a possible out of bounds write and read due to a missing bounds check," classified under CWE-787 (Out-of-bounds Write). This means that when processing attacker-influenced input, the code path fails to validate that a length, index, or offset falls within the bounds of the destination/source buffer before performing a read or write. The result is both an out-of-bounds write (memory corruption, potential controlled overwrite of adjacent structures) and an out-of-bounds read (potential disclosure of adjacent memory contents).

Attack surface considerations (at the vulnerability-class level, since the description does not enumerate specific functions or parameters):

• The ccci interface is a privileged kernel-level driver; it is reachable from userspace through ioctl-style interfaces, debugfs/procfs nodes, or shared-memory ring buffers used for AP/BP messaging. (Inference based on the subsystem class; no specific path is confirmed by the CVE data.)
• Because the missing check applies "due to a missing bounds check," the trigger is most plausibly an input message whose embedded length/index field is trusted without validation against the actual buffer size.
• Both a read primitive and a write primitive are described, which is consistent with a single unchecked offset being used in both load and store operations, or with two symmetric unchecked accessors.

No code-level identifiers (function names, ioctl numbers, module paths) are given in the NVD description; therefore the precise sink cannot be named without fabrication. What can be asserted from the data: the flaw is in the ccci component, it is a bounds-check omission, and it yields OOB read and write primitives.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-20528. The attack chain below is described at the vulnerability-class level and is strictly bounded by the NVD description.

1. Reconnaissance / precondition check. The attacker must already hold System privilege on the target device (as stated in the description). This is a post-compromise escalation step rather than an entry vector. The attacker identifies the target SoC family to select the appropriate exploitation strategy (e.g., MT6986 vs MT2735 automotive variants).

2. Triggering the flaw. The attacker supplies crafted input through whatever interface exposes the ccci component, using a value (such as a length or index) that bypasses the missing bounds check. Because the description explicitly requires User interaction, a crafted file, message, or application action is likely used to deliver the malformed input into the driver. The out-of-bounds access then occurs in the kernel context of the driver.

3. Payload / execution method (class-level). For the write primitive, the goal is to corrupt an adjacent kernel structure to alter a security-relevant field or redirect control flow. For the read primitive, the goal is to exfiltrate adjacent memory (potentially keys, pointers, or cross-core buffers) back to the attacker's System-privileged context — yielding information disclosure. No specific structures, gadgets, or offsets are named in the CVE data, so no such detail is asserted here.

4. Post-exploitation impact. Successful use can produce:

   • Local information disclosure (out-of-bounds read),
   • Memory corruption or crashes (out-of-bounds write),
   • Privilege escalation beyond the originating System privilege (the description explicitly lists privilege escalation as a possible outcome).

The combination of an already-obtained System privilege plus user interaction defines a deliberate, multi-stage exploitation model; the vulnerability does not provide remote unauthenticated code execution on its own.

Impact Assessment

• Confidentiality: High — the out-of-bounds read is described as leading to "local information disclosure."
• Integrity: High — memory corruption from an out-of-bounds write.
• Availability: High — "crashes" are explicitly named.
• Privilege boundary: escalation from System privilege into a more privileged context (kernel/modem-adjacent).

Blast radius: all listed MediaTek platforms — mobile (MT6880, MT6890, MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988) and automotive (MT2735, MT2737). Automotive deployment raises the risk profile because the affected SoCs power in-vehicle systems where a crash or privilege escalation may have safety implications and a longer field lifetime.

No CVSS score, EPSS score, or CISA KEV listing is available. Patch confidence is 0/4 — no patch evidence is present in any tracked source, and no affected version range was supplied. Treat as UNPATCHED pending vendor response.

Detection Guidance

Sigma Rule

title: MediaTek ccci Out-of-Bounds Access Attempt (CVE-2026-20528)
id: 6f2a9c3e-2d4b-4e7a-9c1f-8b5d7e0a3f21
status: experimental
description: Detects anomalous access patterns and crashes associated with the MediaTek ccci driver out-of-bounds write/read (CVE-2026-20528).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20528
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_module:
    - 'ccci'
    - 'CCCI'
    - 'mtk_ccci'
    - 'ccci_md'
  selection_events:
    - 'Kernel panic'
    - 'BUG: unable to handle kernel paging request'
    - 'general protection fault'
    - 'slab-out-of-bounds'
    - 'Out of bounds'
  condition: selection_module and selection_events
falsepositives:
  - Legitimate modem/AP recovery after driver reset
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.20528

YARA Rule

rule CVE_2026_20528_MediaTek_ccci_OOB
{
    meta:
        description = "Detects artifacts / binaries referencing MediaTek ccci component related to CVE-2026-20528"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20528"
        date = "2026-01-01"
        cve = "CVE-2026-20528"
        severity = "high"

    strings:
        $ccci1 = "ccci" ascii wide
        $ccci2 = "CCCI" ascii wide
        $ccci3 = "ccci_md" ascii wide
        $ccci4 = "mtk_ccci" ascii wide
        $patch1 = "ALPS11428950" ascii wide
        $patch2 = "ALPS10563453" ascii wide
        $patch3 = "AUTO00858766" ascii wide
        $issue = "MSV-9893" ascii wide

    condition:
        uint32(0) == 0x464c457f and any of ($ccci*) or any of ($patch*) or $issue
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-20528 MediaTek ccci Out-of-Bounds Access POST-BODY"; flow:established,to_server; content:"ccci"; http_uri; nocase; classtype:attempted-admin; reference:cve,2026-20528; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-20528; sid:202620528; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name != null and
  (
    process.command_line : "*ccci*" or
    process.command_line : "*CCCI*" or
    process.command_line : "*mtk_ccci*" or
    process.command_line : "*ccci_md*"
  ) and
  not process.parent.name in ("init", "systemd", "modprobe")

Splunk SPL Query

index=linux_logs sourcetype=syslog OR sourcetype=kernel
| search ("ccci" OR "CCCI" OR "mtk_ccci" OR "ccci_md")
| search ("out of bounds" OR "Out of bounds" OR "slab-out-of-bounds" OR "general protection fault" OR "unable to handle kernel paging request" OR "Kernel panic")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="mediatek,cve-2026-20528,">
  <rule id="100528" level="12">
    <decoded_as>syslog</decoded_as>
    <match>ccci|CCCI|mtk_ccci|ccci_md</match>
    <description>CVE-2026-20528: MediaTek ccci driver activity detected - possible out-of-bounds write/read exploitation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,memory_corruption,</group>
  </rule>

  <rule id="100529" level="14">
    <if_sid>100528</if_sid>
    <match>out of bounds|Out of bounds|slab-out-of-bounds|general protection fault|unable to handle kernel paging request|Kernel panic</match>
    <description>CVE-2026-20528: Correlated ccci memory-safety fault - likely exploitation attempt</description>
    <group>privilege_escalation,memory_corruption,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict and audit which applications can hold System privilege on affected MediaTek devices; the flaw explicitly requires a pre-existing System privilege plus user interaction.
   • Minimize user interaction with untrusted content that could reach the ccci driver (malicious files, messages, or app inputs).
   • Apply mobile device management (MDM) policies to block sideloaded/unknown apps that could trigger the user-interaction vector.
   • For automotive deployments, isolate the affected SoC domain from safety-critical and external-facing interfaces and monitor for unexpected restarts or kernel panics.

2. Patch / upgrade steps

   • Apply the vendor-supplied patch reference for the exact SoC:
     • MT6880, MT6890 → ALPS11428950
     • MT6980D, MT6990, MT6986, MT6986D, MT6813, MT6988 → ALPS10563453
     • MT2735, MT2737 → AUTO00858766
   • Track the vendor security bulletin corresponding to Issue ID MSV-9893 for availability and device-specific firmware builds.
   • Verify kernel/security patch level after update; confirm the fix build includes the applicable ALPS/AUTO reference.

3. Long-term hardening

   • Enable kernel hardening (KASAN in test builds, KASLR, CFI where supported) to harden against OOB read/write classes.
   • Enforce least-privilege app models and continuous monitoring of kernel-level fault telemetry.
   • Adopt a firmware-update policy that tracks MediaTek ALPS/AUTO patch identifiers so this and related ccci vulnerabilities are promptly remediated across device fleets.

References

• NVD — CVE-2026-20528: https://nvd.nist.gov/vuln/detail/CVE-2026-20528
• MITRE CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• MediaTek Product Security Bulletins (reference Issue ID MSV-9893): https://www.mediatek.com/product-security-bulletin
• MediaTek Security Advisory lookup by Patch ID (ALPS11428950 / ALPS10563453 / AUTO00858766): https://www.mediatek.com/security
• CISA Known Exploited Vulnerabilities Catalog (verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit-in-the-wild evidence, or named threat-actor campaign is associated with CVE-2026-20528 at the time of writing.