Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-20447: Google component may let attackers gain higher rights

CVE-2026-20447 · published 5 months ago

Summary

A missing bounds check in the geniezone component could let an attacker who already has system-level access increase their privileges without any user interaction. This could let the attacker take full control of the affected system. Apply the provided patch (ALPS10724073) or update the software to fix the issue.

What to do

Update google :unknown: to version SoCVersion:2026-06-05.

Affected software

Ecosystem	Vendor	Product	Affected versions
Android	google	:unknown:	>= SoCVersion:0, < SoCVersion:2026-06-05 Fix: upgrade to SoCVersion:2026-06-05
–	mediatek	mt6768_firmware	All versions `cpe:2.3:o:mediatek:mt6768_firmware:-:::::::*`
–	mediatek	mt6789_firmware	All versions `cpe:2.3:o:mediatek:mt6789_firmware:-:::::::*`
–	mediatek	mt6877_firmware	All versions `cpe:2.3:o:mediatek:mt6877_firmware:-:::::::*`
–	mediatek	mt6899_firmware	All versions `cpe:2.3:o:mediatek:mt6899_firmware:-:::::::*`
–	mediatek	mt6989_firmware	All versions `cpe:2.3:o:mediatek:mt6989_firmware:-:::::::*`
–	mediatek	mt6991_firmware	All versions `cpe:2.3:o:mediatek:mt6991_firmware:-:::::::*`
–	mediatek	mt6993_firmware	All versions `cpe:2.3:o:mediatek:mt6993_firmware:-:::::::*`
–	mediatek	mt8196_firmware	All versions `cpe:2.3:o:mediatek:mt8196_firmware:-:::::::*`
–	mediatek	mt8367_firmware	All versions `cpe:2.3:o:mediatek:mt8367_firmware:-:::::::*`
–	mediatek	mt8766_firmware	All versions `cpe:2.3:o:mediatek:mt8766_firmware:-:::::::*`
–	mediatek	mt8768_firmware	All versions `cpe:2.3:o:mediatek:mt8768_firmware:-:::::::*`
–	mediatek	mt8781_firmware	All versions `cpe:2.3:o:mediatek:mt8781_firmware:-:::::::*`
–	mediatek	mt8786_firmware	All versions `cpe:2.3:o:mediatek:mt8786_firmware:-:::::::*`
–	mediatek	mt8788e_firmware	All versions `cpe:2.3:o:mediatek:mt8788e_firmware:-:::::::*`
–	mediatek	mt8791t_firmware	All versions `cpe:2.3:o:mediatek:mt8791t_firmware:-:::::::*`
–	mediatek	mt8793_firmware	All versions `cpe:2.3:o:mediatek:mt8793_firmware:-:::::::*`
–	mediatek	mt8910_firmware	All versions `cpe:2.3:o:mediatek:mt8910_firmware:-:::::::*`

Original advisory text

ASB-A-488940382

In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10724073; Issue ID: MSV-6296.

References

https://source.android.com/security/bulletin/2026-06-01 Vendor Advisory
https://corp.mediatek.com/product-security-bulletin/May-2026 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

6.7 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published1 Jun 2026

Updated26 Oct 2026

First seen4 May 2026

Sources

CVE-2026-20447 · NVD

ASB-A-488940382 · OSV

Track software like this

Free during beta