CVE-2020-0069: Mediatek Out-of-Bounds Escalation

CVE-2020-0069 identifies an out-of-bounds write vulnerability in ioctl handlers of the Mediatek Command Queue driver on Android devices. The flaw stems from insufficient input sanitization and missing SELinux restrictions, and directly affects the Android kernel. A local attacker can exploit it to achieve privilege escalation without requiring additional privileges or user interaction.

The vulnerability has a CVSS score of 7.8, classified as High. It was officially documented in NVD on March 10, 2020 with Android ID A-147882143. While the CVE was published in 2020, a public repository signal was recorded in November 2026, indicating the flaw continues to receive attention from researchers and developers. Specific affected versions are not published in official documentation.

To defend against this, review SELinux configuration on all Android devices in your environment. Contact the device manufacturer to check for available security patches and apply them as soon as they become available. If the device no longer receives updates, evaluate its support lifecycle and plan replacement accordingly. Keep custom or modified kernels patched if in use.