MediaTek Audio HAL CVE-2026-20480

Exploitation requires an attacker to already have local code execution capability on the target device with at minimum standard user-level privileges, as confirmed by CVSS AV:L and PR:L. The device must be powered by one of the seven affected MediaTek chipsets: MT6880, MT6890, MT6980D, MT6988, MT6990, MT2735, or MT3737. No user interaction is required beyond the attacker's own code execution (UI:N). Remote exploitation is impossible - the local attack vector is confirmed by the CVSS vector and is consistent with a HAL-level flaw reachable only from on-device processes. Scope is unchanged (S:U), so the impact does not propagate beyond the audio subsystem to other system components or the kernel. Limiting factors: the attacker must already possess device access and code execution capability, the affected component is the audio subsystem only, and the outcome is denial of service rather than code execution or data exposure.

The CVSS 5.5 Medium score accurately reflects the constrained threat model: AV:L requires local presence, PR:L requires pre-existing user-level code execution, and the impact is availability-only (A:H, C:N, I:N) with unchanged scope (S:U). These metrics align tightly with the description - there is no conflict between the CVSS vector and the vulnerability narrative. EPSS at 0.15% (5th percentile) is very low, indicating no observed exploitation pressure in threat intelligence feeds. The CISA SSVC assessment reinforces this: exploitation is 'none,' the attack is not automatable, and technical impact is only partial. The vulnerability is not listed in CISA KEV. Taken together, these signals consistently characterize this as a low real-world priority: it cannot serve as an initial access vector (local execution already required), its impact is limited to crashing the audio service rather than achieving code execution or data exfiltration, and no exploitation activity has been identified. Organizations managing large fleets of affected MediaTek-based devices should apply available patches in routine update cycles rather than treating this as an emergency.

A malicious Android application installed on a device running an affected MediaTek chipset (MT6880, MT6890, MT6980D, MT6988, MT6990, MT2735, or MT3737) invokes audio system calls or APIs that trigger the out-of-bounds write in the Audio HAL heap buffer, causing the audio service to crash. Because no user interaction is required beyond the app's own execution, the app could loop this operation repeatedly to sustain a persistent denial of service against the device's audio subsystem. No public exploit code has been identified at time of analysis.