MediaTek GPU CVE-2026-20515

Exploitation requires local code execution on the target device with at minimum standard Android user-level privileges (PR:L per vendor CVSS). The device must be equipped with a MediaTek MT6991 or MT8799 chipset running firmware predating patch ALPS11122991. The description states 'User interaction is needed for exploitation,' though the specific interaction (e.g., opening a file, viewing content that triggers a GPU render path) is not described - this conflicts with the vendor CVSS UI:N and should be treated with caution. Remote or network-based exploitation is not applicable (AV:L). The attack is not automatable per SSVC (Automatable: no), indicating it cannot be reliably scripted for mass targeting without device-specific conditions.

The vendor-assigned CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly constrains the attack surface to local access with user-level privileges, significantly limiting the population of viable attackers. However, a notable inconsistency exists: the textual description explicitly states 'User interaction is needed for exploitation,' directly contradicting the vendor CVSS UI:N metric - this should be verified with MediaTek, as UI:R would further reduce exploitability and the CVSS base score. A second inconsistency: the description mentions 'system crash' and the Tags include 'Denial Of Service,' yet the vendor CVSS scores A:N - this may indicate the crash is an incidental rather than guaranteed outcome, or that the vendor chose to score only the primary exploitation path. SSVC reports exploitation as 'none' and automatable as 'no,' both consistent with a local-only attack requiring specific GPU interaction. No EPSS data was provided. The absence of KEV listing and any public exploit code further reduces urgency. Real-world risk is best characterized as low-to-moderate: the C:H rating is meaningful for kernel memory exposure, but the local-only vector and apparent user-interaction requirement substantially constrain exploitability.

A malicious Android app with no elevated permissions on a device equipped with MediaTek MT6991 or MT8799 submits a crafted sequence of GPU driver ioctl calls that triggers the use-after-free condition, causing the driver to dereference a freed memory object. The app then reads the stale memory region - potentially containing kernel pointers, session tokens, or cryptographic material - before the allocator overwrites it. In an alternate path, the dereference triggers a kernel panic, rebooting the device. No public exploit code has been identified at time of analysis.