{"id":"CVE-2026-20516","title":"In MiracastService, there is a possible escalation of privilege due to a confused deputy","summary":"In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-926"],"vendor":"MediaTek, Inc.","product":"MediaTek chipset","affected":["mediatek_chipset MT5586","mediatek_chipset MT5836","mediatek_chipset MT5838","mediatek_chipset MT5867","mediatek_chipset MT9011","mediatek_chipset MT9012","mediatek_chipset MT9015","mediatek_chipset MT9022","mediatek_chipset MT9025","mediatek_chipset MT9026","mediatek_chipset MT9027","mediatek_chipset MT9032","mediatek_chipset MT9033","mediatek_chipset MT9216","mediatek_chipset MT9221","mediatek_chipset MT9256","mediatek_chipset MT9266","mediatek_chipset MT9270","mediatek_chipset MT9286","mediatek_chipset MT9603","mediatek_chipset MT9615","mediatek_chipset MT9617","mediatek_chipset MT9618","mediatek_chipset MT9633","mediatek_chipset MT9636","mediatek_chipset MT9638","mediatek_chipset MT9649","mediatek_chipset MT9660","mediatek_chipset MT9666","mediatek_chipset MT9667","mediatek_chipset MT9671","mediatek_chipset MT9676","mediatek_chipset MT9687","mediatek_chipset MT9688","mediatek_chipset MT9689","mediatek_chipset MT9952","mediatek_chipset MT9972","mediatek_chipset MT9979","mediatek_chipset MT9982"],"published":"2026-09-07","updated":"2026-09-22","sourceUpdated":"2026-09-22T03:16:56.330","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20516","references":[{"url":"https://www.mediatek.com/product-security-bulletin/September-2026","label":"security@mediatek.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-07T10:36:14.560696Z"},"epss":0.00132,"epssPercentile":0.02307,"exploits":{"github":1,"githubRepos":["https://github.com/Dingo97/CVE-2026-20516"],"checkedAt":"2026-09-27T10:33:41.901Z"},"exploitAvailable":true,"ingestedAt":"2026-09-07T12:10:16.376Z","slug":"CVE-2026-20516","body":"## Overview\n\nIn MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11060069 / DTV04881615; Issue ID: MSV-7882.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":201474,"id":"CVE-2026-20516","ts":1789399487664,"field":"exploit_available","old":"false","new":"true"},{"seq":200208,"id":"CVE-2026-20516","ts":1789397014704,"field":"exploit_available","old":"true","new":"false"},{"seq":198132,"id":"CVE-2026-20516","ts":1789391713767,"field":"exploit_available","old":"false","new":"true"},{"seq":195925,"id":"CVE-2026-20516","ts":1789383361385,"field":"exploit_available","old":"true","new":"false"},{"seq":194854,"id":"CVE-2026-20516","ts":1789380287991,"field":"exploit_available","old":"false","new":"true"},{"seq":193641,"id":"CVE-2026-20516","ts":1789378226158,"field":"exploit_available","old":"true","new":"false"},{"seq":192428,"id":"CVE-2026-20516","ts":1789376211153,"field":"exploit_available","old":"false","new":"true"},{"seq":191215,"id":"CVE-2026-20516","ts":1789373085800,"field":"exploit_available","old":"true","new":"false"},{"seq":190000,"id":"CVE-2026-20516","ts":1789369109149,"field":"exploit_available","old":"false","new":"true"},{"seq":188787,"id":"CVE-2026-20516","ts":1789368014851,"field":"exploit_available","old":"true","new":"false"},{"seq":187570,"id":"CVE-2026-20516","ts":1789364980688,"field":"exploit_available","old":"false","new":"true"},{"seq":186357,"id":"CVE-2026-20516","ts":1789362963725,"field":"exploit_available","old":"true","new":"false"},{"seq":185143,"id":"CVE-2026-20516","ts":1789360952120,"field":"exploit_available","old":"false","new":"true"},{"seq":183930,"id":"CVE-2026-20516","ts":1789357889839,"field":"exploit_available","old":"true","new":"false"},{"seq":182182,"id":"CVE-2026-20516","ts":1789354076699,"field":"exploit_available","old":"false","new":"true"},{"seq":180975,"id":"CVE-2026-20516","ts":1789352913079,"field":"exploit_available","old":"true","new":"false"},{"seq":179768,"id":"CVE-2026-20516","ts":1789349976852,"field":"exploit_available","old":"false","new":"true"},{"seq":178561,"id":"CVE-2026-20516","ts":1789347767877,"field":"exploit_available","old":"true","new":"false"},{"seq":177354,"id":"CVE-2026-20516","ts":1789346158621,"field":"exploit_available","old":"false","new":"true"},{"seq":176147,"id":"CVE-2026-20516","ts":1789342702567,"field":"exploit_available","old":"true","new":"false"},{"seq":175931,"id":"CVE-2026-20516","ts":1789342312984,"field":"exploit_available","old":"false","new":"true"},{"seq":175471,"id":"CVE-2026-20516","ts":1789338356171,"field":"exploit_available","old":"true","new":"false"},{"seq":174266,"id":"CVE-2026-20516","ts":1789334582125,"field":"exploit_available","old":"false","new":"true"},{"seq":173061,"id":"CVE-2026-20516","ts":1789333181558,"field":"exploit_available","old":"true","new":"false"},{"seq":171875,"id":"CVE-2026-20516","ts":1789330869076,"field":"exploit_available","old":"false","new":"true"},{"seq":170689,"id":"CVE-2026-20516","ts":1789328364479,"field":"exploit_available","old":"true","new":"false"},{"seq":169484,"id":"CVE-2026-20516","ts":1789326879790,"field":"exploit_available","old":"false","new":"true"},{"seq":168279,"id":"CVE-2026-20516","ts":1789323398047,"field":"exploit_available","old":"true","new":"false"},{"seq":167074,"id":"CVE-2026-20516","ts":1789319353089,"field":"exploit_available","old":"false","new":"true"},{"seq":165869,"id":"CVE-2026-20516","ts":1789318224917,"field":"exploit_available","old":"true","new":"false"},{"seq":164664,"id":"CVE-2026-20516","ts":1789315522395,"field":"exploit_available","old":"false","new":"true"},{"seq":163459,"id":"CVE-2026-20516","ts":1789313225834,"field":"exploit_available","old":"true","new":"false"},{"seq":162254,"id":"CVE-2026-20516","ts":1789311700623,"field":"exploit_available","old":"false","new":"true"},{"seq":161049,"id":"CVE-2026-20516","ts":1789308217456,"field":"exploit_available","old":"true","new":"false"},{"seq":160554,"id":"CVE-2026-20516","ts":1789304166390,"field":"exploit_available","old":"false","new":"true"},{"seq":158392,"id":"CVE-2026-20516","ts":1789299243837,"field":"exploit_available","old":"true","new":"false"},{"seq":157356,"id":"CVE-2026-20516","ts":1789296449437,"field":"exploit_available","old":"false","new":"true"},{"seq":156151,"id":"CVE-2026-20516","ts":1789294345901,"field":"exploit_available","old":"true","new":"false"},{"seq":154946,"id":"CVE-2026-20516","ts":1789292624094,"field":"exploit_available","old":"false","new":"true"},{"seq":153741,"id":"CVE-2026-20516","ts":1789289313960,"field":"exploit_available","old":"true","new":"false"},{"seq":152953,"id":"CVE-2026-20516","ts":1789285216814,"field":"exploit_available","old":"false","new":"true"},{"seq":152197,"id":"CVE-2026-20516","ts":1789280933573,"field":"exploit_available","old":"true","new":"false"},{"seq":151158,"id":"CVE-2026-20516","ts":1789277443107,"field":"exploit_available","old":"false","new":"true"},{"seq":150124,"id":"CVE-2026-20516","ts":1789275874238,"field":"exploit_available","old":"true","new":"false"},{"seq":149091,"id":"CVE-2026-20516","ts":1789273608045,"field":"exploit_available","old":"false","new":"true"},{"seq":147887,"id":"CVE-2026-20516","ts":1789270848463,"field":"exploit_available","old":"true","new":"false"},{"seq":145927,"id":"CVE-2026-20516","ts":1789269164228,"field":"exploit_available","old":"false","new":"true"}]}