MediaTek APU CVE-2026-20524

Exploitation requires the attacker to already execute code locally on the affected device (e.g., a malicious or compromised Android app) and to reach the MediaTek APU driver/interface to deliver malformed input; this is consistent with AV:L. No user interaction and no elevated privileges are needed once local code runs (UI:N, and MediaTek's 'no additional execution privileges needed' phrasing). Limiting factors: the device must use one of the affected MediaTek chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668) and must be unpatched (pre-ALPS11249004); there is no remote network vector, so an attacker cannot exploit this without first gaining a local foothold on the device.

This is a genuine high-severity local privilege escalation in MediaTek's APU (AI Processing Unit) component, carrying a vendor-assigned CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent: local attack vector, low complexity, no privileges and no user interaction required, with full high impact to confidentiality, integrity and availability - meaning a malicious local app could corrupt memory and escalate to higher-privileged (kernel/firmware) context. However, several key real-world exploitation signals are MISSING from the input: there is no EPSS probability provided, no CISA KEV listing, and no public POC referenced, so exploitation likelihood cannot be quantified from the data. Exploitation status is therefore: no public exploit identified at time of analysis. Note the PR:N designation reflects MediaTek's convention (no special execution privileges beyond the ability to run local code), but exploitation still requires an attacker to already have code execution on the device - e.g., a malicious or compromised app - which is a meaningful barrier compared to a remote flaw. Net: a real patching priority for affected MediaTek-based fleets, but not a drop-everything remote threat; prioritize it in the normal Android/OEM monthly patch cycle unless a POC emerges.

A user installs a malicious Android app (or an existing app is compromised) that interacts with the MediaTek APU driver interface. The app sends crafted, improperly-validated input to the APU, triggering memory corruption that overwrites privileged memory and elevates the app's privileges to kernel or firmware context without any user interaction. No public exploit code is currently identified, so this remains a theoretical-but-credible chain based on the CVSS local vector and CWE-1285 input-validation weakness.