{"id":"CVE-2026-20572","kind":"vulnerability","aliases":["CVE-2026-20572"],"related":[],"title":"adsp: integer overflow lets a system-level process write out of bounds","description":"In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.","summary":"An integer overflow in the adsp component allows an out-of-bounds write in memory. An attacker who already holds System privilege on the device can use it to escalate privileges further.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mediatek"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:34+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","triaged_at":"2026-11-02T03:32:22+00:00","updated_at":"2026-11-02T03:32:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T03:32:22Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"adsp: integer overflow lets a system-level process write out of bounds","impact":"medium","summary":"An integer overflow in the adsp component allows an out-of-bounds write in memory. An attacker who already holds System privilege on the device can use it to escalate privileges further.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["mediatek","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker with System privilege escalates to higher privilege on device","analyst_note":"Confirm affected chipsets and patched Android security bulletin version for Patch ID ALPS11431442 from the vendor bulletin.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000583,"input_tokens":4101,"output_tokens":346,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-20572':16A,19A '-9924':101C 'actor':81C 'adsp':1A,28B,56C 'allow':30B 'alps11431442':97C 'alreadi':42B,83C 'android':20B 'attack':40B 'bound':13A,35B,63C 'compon':29B 'could':71C 'cve':14A,17A 'devic':48B 'due':65C 'escal':53B,75C 'exploit':94C 'hold':43B 'id':96C,99C 'infrastructur':21B 'integ':2A,24B,68C 'interact':89C 'issu':98C 'lead':72C 'let':4A 'level':8A 'local':74C 'malici':80C 'mediatek':22B 'memori':38B 'msv':100C 'need':92C 'obtain':84C 'out-of-bound':32B 'overflow':3A,25B,69C 'patch':95C 'possibl':60C 'privileg':45B,54B,77C,87C 'process':9A 'system':7A,44B,86C 'system-level':6A 'use':50B 'user':88C 'write':10A,36B,64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mediatek","unknown"],"first_public_at":"2026-11-02T03:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20572","severity":null,"published_at":"2026-11-02T03:17:34+00:00","modified_at":"2026-11-02T03:17:34+00:00","first_seen_at":"2026-11-02T03:31:25+00:00","fetched_at":"2026-11-02T03:31:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}