CVE-2026-20418: Thread Out-of-Bounds Write Enabling Remote Privilege Escalation (MediaTek)
MediaTek's February 2026 bulletin covers CVE-2026-20418, an out-of-bounds write (CWE-787) caused by a missing bounds check in the Thread component. The CNA scores it 9.8 (Critical) under CVSS 3.1 and says it could allow remote privilege escalation without user interaction. The record lists no fixed version and the CISA KEV catalog does not list it.
Overview
MediaTek published CVE-2026-20418 in its February 2026 product security bulletin. The record describes an out-of-bounds write caused by a missing bounds check in the Thread component, classified by the CNA as CWE-787.
Impact
According to the record, the flaw could lead to remote escalation of privilege without additional execution privileges and without user interaction. The CNA's CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which reflects high confidentiality, integrity and availability impact.
Affected products and versions
- Product listed in the record: Google Matter
- Versions listed in the record: 1.4 and earlier (≤ 1.4)
The description refers to Thread, while the affected product field lists Google Matter. The record does not explain how these relate, so organizations should confirm affected components and builds against the vendor bulletin.
Exploitation status
The CVE is not listed in the CISA KEV catalog in this record. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
The record includes Patch ID WCNCR00465153 but no fixed version. The absence of a listed fixed version does not mean that no fix exists. Review the MediaTek February 2026 bulletin, contact the vendors of affected products, and apply updates as soon as they are published.
- Inventory devices and products that use the affected component.
- Prioritize updates for exposed or remotely reachable systems.
Detection guidance
- Keep firmware and software inventories of affected products current.
- Monitor vendor and national CERT channels for updated advisories.
- Watch for unexpected crashes, reboots or abnormal network behavior on affected devices. These are general signs of memory corruption issues and are not specific indicators for this CVE.
Limitations of the available information
The record has no title, no fixed version list, no EPSS score and no SSVC data. The mapping between the Thread component and the listed Google Matter product is not stated. Details of the vulnerable code path and technical exploitation conditions are not in the sources consulted, and this analysis does not provide them.
Frequently asked questions
Is CVE-2026-20418 known to be actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted for this analysis.
Is there a fixed version for CVE-2026-20418?
The record does not list a fixed version, but it includes Patch ID WCNCR00465153. Check the MediaTek February 2026 bulletin and the vendor of the affected product for update details.
Which products are listed as affected?
The record lists Google Matter with versions 1.4 and earlier. It describes the flaw in the Thread component, and the relationship between the two is not explained in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.