MediaTek APUSYS CVE-2026-20467

Exploitation requires that the attacker has already obtained Android System privilege - a highly restricted privilege tier above standard application or even privileged user access, typically held only by core Android system services and vendor-signed platform applications. This is the most significant limiting factor: the flaw cannot be reached by standard installed applications or unprivileged users. Affected hardware is specifically limited to devices shipping MediaTek MT8366, MT8196, or MT8195 chipsets with the apusys driver loaded and active; devices on other chipsets or without the APUSYS subsystem are not affected. No user interaction is required once the System privilege prerequisite is met, and no additional non-default configuration is described. Exploitation is local-only - remote exploitation is not possible based on the AV:L vector.

The CVSS base score of 6.0 (Medium) accurately reflects the substantial prerequisite of existing System-level privilege (PR:H), which materially constrains the real-world attack surface. The local-only attack vector (AV:L) eliminates remote exploitation entirely. EPSS at 0.14% (4th percentile) is consistent with an absence of public exploit code and no CISA KEV listing, indicating negligible observed exploitation activity at time of analysis. Despite the High confidentiality and integrity impact (C:H/I:H), this vulnerability is primarily a post-compromise escalation primitive rather than an initial-access vector - threat actors would need to have already compromised System privileges before leveraging this flaw. Scope remains Unchanged (S:U), so lateral movement to other systems is not directly facilitated. The primary realistic risk scenario involves malicious or compromised applications operating at Android System privilege level on affected hardware.

An attacker or malicious privileged application that has previously obtained Android System-level access on a device powered by an MT8366, MT8196, or MT8195 chipset crafts out-of-bounds parameters and submits them to the exposed apusys driver function that lacks proper bounds validation. The missing check allows the attacker to trigger controlled behavior beyond the intended input range, escalating privileges beyond the System level to access protected kernel memory or sensitive hardware-backed data. No public proof-of-concept exploit has been identified at time of analysis.