MediaTek AIDL CVE-2026-20536

Exploitation requires the attacker to have already obtained Android System-level privilege on an affected MediaTek chipset device, and to reach the vulnerable code path in the aidl component to trigger the use-after-free. No user interaction is required (UI:N) and the attack is local (AV:L) - there is no network-facing exposure. Limiting factors: the PR:H prerequisite means this cannot be used for initial access and only works as a follow-on escalation from an already-compromised privileged context; it is also constrained to the enumerated MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) running unpatched firmware.

This is a genuine but access-gated local privilege escalation, not a broadly exploitable remote flaw. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U, 6.7 MEDIUM) is internally consistent with the description: it is a use-after-free (CWE-416) reachable only after an attacker has ALREADY obtained the Android System privilege, from which it escalates further (likely toward kernel/root-level or cross-component control). The PR:H requirement is the dominant limiting factor and sharply narrows real-world risk - an attacker must first compromise a highly privileged process, so this is realistically a second-stage/chaining primitive rather than an initial foothold. No EPSS score was provided in the input, there is no CISA KEV listing, and no public POC is referenced, so all three exploitation-likelihood signals are either absent or negative. Reported directly by the vendor (security@mediatek.com) via the October 2026 Product Security Bulletin, consistent with coordinated disclosure rather than observed attacks. Net: a legitimate patch-worthy issue for the Android/MediaTek ecosystem but lower operational priority than the raw CWE class suggests, because exploitation presupposes existing System-level compromise.

An attacker who has already compromised a System-privileged process on a MediaTek-based Android device (e.g., via a prior vulnerability or a malicious privileged component) triggers the use-after-free in the aidl component to corrupt memory and escalate beyond System toward kernel/root-level control. No user interaction is required. No public exploit code was identified in the provided data, so this remains a theoretical chain pending a working primitive.