MediaTek Audio HAL CVE-2026-20492

Exploitation requires local code execution on the target device with at minimum user-level (non-root) privileges - confirmed by the CVSS vector PR:L. The vulnerability is present only on devices incorporating one of the six affected MediaTek chipsets: MT2735, MT2737, MT6880, MT6890, MT6988, or MT6990. No network access is required (AV:L). No user interaction is needed (UI:N). Limiting factors include the strict local attack vector (remote exploitation is not possible), the requirement for some form of code execution on the device (e.g., sideloaded app, adb shell, or supply chain compromise), and the race condition timing dependency that may reduce reliable exploit reproducibility despite the vendor's AC:L assessment.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 (Medium). The attack vector is strictly local, requires only user-level privileges, and produces no confidentiality or integrity impact - purely a denial-of-service condition. The vendor-assessed AC:L is worth scrutinizing: CWE-367 TOCTOU race conditions typically require precise timing, suggesting AC:H may be more accurate, though MediaTek assessed the complexity as low, possibly due to easily reproducible timing windows in the HAL's audio state machine. EPSS at 0.12% (2nd percentile) confirms that the security community has observed no significant exploitation activity. The absence of a CISA KEV listing and no public POC further support a low operational priority. The realistic risk is limited to an attacker who already has local code execution on the device - at which point a DoS of audio services is a relatively minor escalation. This is not a high-priority patching emergency for most defenders, but remains relevant for device manufacturers and OEMs shipping products with these chipsets.

A malicious or compromised user-space application running on a device with an affected MediaTek chipset repeatedly invokes Audio HAL operations from multiple threads, exploiting the TOCTOU window to corrupt audio device state. The race condition causes the Audio HAL service to hang or deadlock, propagating to system unresponsiveness. No public proof-of-concept exploit has been identified; successful exploitation would require precise thread timing, which may be achievable through repeated attempts.