MediaTek Video HAL CVE-2026-20521

Requires an attacker to already have local code execution on the device - typically an unprivileged app installed on an affected MediaTek-chipset Android device - that can reach the Video HAL interface and supply crafted input triggering the missing bounds check. Per the CVSS vector (AV:L/PR:N/UI:N), no additional privileges and no user interaction are needed once such local access exists, and default configurations appear affected. The primary limiting factor is the local attack vector: remote exploitation over a network is not indicated, so the flaw is an escalation primitive that presupposes prior on-device access, and it is scoped to the listed MediaTek chipsets (MT6xxx/MT8xxx/MT2718 families) running the unpatched Video HAL.

This is a genuine high-priority local privilege escalation, not merely an inflated CVSS number. The vendor-supplied CVSS:3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) is internally consistent with the description: a missing bounds check in the Video HAL (CWE-121, stack-based buffer overflow) reachable locally with no privileges and no user interaction, yielding full confidentiality, integrity, and availability impact - effectively kernel/system-level code execution from an unprivileged context. The key mitigating signal is the attack vector: AV:L means exploitation requires local code execution first (e.g., a malicious or compromised app already on the device), so this is a chaining/escalation primitive rather than a remote entry point. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or widespread exploitation; absence of these signals is not proof of safety but does lower the immediate urgency relative to remotely-exploitable KEV-listed flaws. The decisive risk factor here is prevalence - MediaTek chipsets are in an enormous number of Android devices - so despite the local-only vector, the sheer deployment footprint and the clean no-UI/no-privilege escalation make this a priority patch for the October 2026 MediaTek security bulletin cycle.

A user installs a seemingly benign app that, running with no special permissions, sends crafted input to the Video HAL interface and overflows a stack buffer due to the missing bounds check. The overflow is used to execute code in the privileged media/HAL context, letting the app escalate from an unprivileged sandbox to full system/kernel-level control without any user interaction. No public exploit code is identified in the provided data, so real-world exploitation would currently require an attacker to independently develop the exploit.