MediaTek APU CVE-2026-20531

Exploitation requires the attacker to already have local code execution on a device using an affected MediaTek chipset (MT8781, MT6993, MT6899, MT8668, MT8910, MT8793) - typically a locally installed app or other on-device foothold - because the attack vector is Local (AV:L), not network-reachable. Once local, no special configuration, no elevated privileges (PR:N, 'no additional execution privileges needed'), and no user interaction (UI:N) are required to reach the vulnerable APU driver and trigger the use-after-free. The primary limiting factor is the need for prior on-device execution; the main de-limiting factors are that it works against default configurations, needs no user interaction, and has low attack complexity.

This is a genuinely high-severity local privilege escalation in the MediaTek APU (AI Processing Unit) driver stack, scoring CVSS 8.4 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent and credible: a use-after-free (CWE-416) yielding full confidentiality, integrity, and availability impact is the classic primitive for kernel-level privilege escalation on Android. Low attack complexity (AC:L), no required privileges (PR:N - MediaTek explicitly notes 'no additional execution privileges needed'), and no user interaction (UI:N) mean any local code already executing on the device (e.g., a low-privilege or unprivileged installed app) can attempt it reliably. The key limiting factor is the Local attack vector (AV:L): this is NOT remotely exploitable and requires the attacker to already have code execution on the device, which is why it rates 8.4 rather than 9.x. Critically, no EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no evidence of active exploitation or public PoC - this tempers real-world urgency relative to the raw score. Net: a real priority for the mobile/device-patching pipeline (strong local EoP primitive in a ubiquitous chipset family), but not an emergency 'drop everything' remote threat; prioritize via normal Android/vendor monthly patch cadence.

A malicious or compromised Android application installed on a device with an affected MediaTek chipset invokes the vulnerable APU driver interface and triggers the use-after-free condition to corrupt kernel memory. By grooming freed memory and reclaiming it with attacker-controlled data, the app escalates from its unprivileged sandbox to kernel/system privileges without any user interaction. No public exploit code was identified at time of analysis, but UAF-to-EoP primitives in mobile kernel drivers are well-understood and realistically weaponizable.