Autocrypt, the Korean automotive cybersecurity firm, said its red team found two flaws in Little Kernel, the open-source bootloader that runs before the main system on many MediaTek chips. MediaTek assigned CVE-2026-20466 to one of them.
The second arrived through MediaTek’s bug bounty program and was filed as CVE-2026-50971, earning the team a reward. Autocrypt reported it to the chipmaker and to the Little Kernel project, and the fix reached the upstream source.
The bootloader is a tempting target. It loads and verifies the operating system before the usual defenses are running, so a flaw there sits underneath the layers a secure boot chain is meant to protect. Autocrypt did not publish exploitation details.
The team has been building its vehicle work steadily. It placed first among 83 squads at the Car Hacking Village capture-the-flag contest at DEF CON 34 in August, and runs fuzzing and penetration testing against vehicles and mobility platforms. Chief executive Kim Deok-soo said the point of widening research past cars was to cover the chips those vehicles depend on.
MediaTek silicon reaches well beyond phones. Its automotive line sits in cockpit and connectivity systems for connected vehicles, which is why a bootloader bug on the platform can ripple into the transport sector.
