What is the CVSS score of CVE-2026-20418?

CVE-2026-20418 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Matter are affected by CVE-2026-20418?

CVE-2026-20418 is a critical remote privilege escalation vulnerability affecting Thread with a 9.8 CVSS score and no available patch.

How to fix or mitigate CVE-2026-20418?

Within 24 hours: Identify and inventory all systems running Thread; assess exposure in production and non-production environments; establish incident response readiness. Within 7 days: Implement network segmentation to isolate Thread services; enable enhanced monitoring and logging for Thread processes; establish vendor communication channels for patch timeline. Within 30 days: Deploy compensating controls (WAF rules, input validation hardening, or service isolation); conduct penetration testing of affected systems; develop and test rollback procedures for Thread upgrades when patches become available.

Matter CVE-2026-20418

CRITICAL

Out-of-bounds Write (CWE-787)

2026-02-02 security@mediatek.com

Privilege Escalation Matter

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 09:15 nvd

CRITICAL 9.8

DescriptionCVE.org

In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00465153; Issue ID: MSV-4927.