{"id":"CVE-2026-20595","kind":"vulnerability","aliases":["CVE-2026-20595"],"related":[],"title":"NeuroPilot: out-of-bounds write lets a process with System privilege escalate","description":"In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.","summary":"NeuroPilot, a MediaTek component, has a missing bounds check that allows an out-of-bounds write. An attacker who already holds System privilege on the device can use it to escalate privilege locally.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","infrastructure","mediatek","neuropilot"],"not_affected_if":["no-system-level-foothold"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T03:17:37+00:00","first_seen_at":"2026-11-02T03:31:26+00:00","triaged_at":"2026-11-02T03:32:06+00:00","updated_at":"2026-11-02T03:32:06+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T03:32:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"NeuroPilot: out-of-bounds write lets a process with System privilege escalate","impact":"medium","summary":"NeuroPilot, a MediaTek component, has a missing bounds check that allows an out-of-bounds write. An attacker who already holds System privilege on the device can use it to escalate privilege locally.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["neuropilot","android","mediatek"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains higher privilege on the device","analyst_note":"Find the affected devices, versions and the patch bulletin for ALPS11263078 (MediaTek security bulletin) to fill fix and how_to_check.","how_to_check":"unknown","plain_action":"unknown","needs_analyst":true,"not_affected_if":["no-system-level-foothold"],"who_is_affected":"Devices that include the NeuroPilot component, which the sources do not identify by model or version. Exposure requires an attacker who already has System privilege, so the risk is limited to local escalation. The sources do not say which devices or versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":4107,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-20595':16A,19A '-9001':105C 'actor':85C 'allow':34B 'alps11263078':101C 'alreadi':44B,87C 'android':20B 'attack':42B 'bound':5A,31B,39B,66C,72C 'check':32B,73C 'compon':27B 'could':75C 'cve':14A,17A 'devic':50B 'due':68C 'escal':13A,55B,79C 'exploit':98C 'hold':45B 'id':100C,103C 'infrastructur':21B 'interact':93C 'issu':102C 'lead':76C 'let':7A 'local':57B,78C 'malici':84C 'mediatek':22B,26B 'miss':30B,71C 'msv':104C 'need':96C 'neuropilot':1A,23B,24B,59C 'obtain':88C 'out-of-bound':2A,36B 'patch':99C 'possibl':63C 'privileg':12A,47B,56B,81C,91C 'process':9A 'system':11A,46B,90C 'use':52B 'user':92C 'write':6A,40B,67C","nicknames":[],"mitigations":[],"who_affected":"Devices that include the NeuroPilot component, which the sources do not identify by model or version. Exposure requires an attacker who already has System privilege, so the risk is limited to local escalation. The sources do not say which devices or versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["android","infrastructure","mediatek","neuropilot","unknown"],"first_public_at":"2026-11-02T03:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20595","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20595","severity":null,"published_at":"2026-11-02T03:17:37+00:00","modified_at":"2026-11-02T03:17:37+00:00","first_seen_at":"2026-11-02T03:31:26+00:00","fetched_at":"2026-11-02T03:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}