MediaTek Audio HAL CVE-2026-20513

Exploitation requires the attacker to already possess System privilege on the target Android device - this is a high-privilege OS tier, above standard app sandboxes and equivalent to core system processes. The vulnerability is in the Audio HAL, which is always present and active on affected MediaTek-based Android devices, so no special optional feature or non-default configuration is needed once System privilege is obtained. Exploitation is limited to local access (AV:L); remote attackers cannot reach this component directly. The primary limiting factor is the PR:H prerequisite: an attacker must chain this with a separate privilege-escalation vulnerability to first achieve System-level execution before this flaw becomes exploitable.

The vendor-assigned CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N is well-calibrated to the actual risk. Attack vector is local and the prerequisite is System privilege, meaning an adversary must have already achieved deep OS compromise before this flaw can be used - severely constraining the threat model. The High confidentiality impact (C:H) is notable: data exposed from the audio subsystem could include audio buffers, DSP state, or configuration data that an attacker could leverage for further reconnaissance. SSVC rates exploitation 'none' and automatable 'no', consistent with the PR:H barrier. EPSS data is not provided, but the local-only, high-privilege requirement strongly implies a very low exploitation probability in the wild. There is no conflict between the CVSS vector and the description - both agree on local access and System privilege requirement. Real-world priority is low in isolation, but moderate if evaluated as part of a privilege-escalation chain where System privilege has already been obtained (e.g., via a preceding kernel or framework vulnerability).

An attacker who has already gained System-level code execution on an Android device with an affected MediaTek chipset - for example, by exploiting a higher-severity framework or kernel vulnerability - crafts a malformed input to the Audio HAL that triggers a path traversal read. The HAL returns data from outside its intended memory or filesystem scope, which the attacker collects for use in further lateral movement or credential harvesting. No public proof-of-concept exploit is known, and the PR:H prerequisite makes opportunistic mass exploitation infeasible.