MediaTek apusys CVE-2026-20542

Exploitation requires the attacker to already possess the Android System privilege (uid system) and local code execution on the device; without pre-existing System-level access the apusys driver interface cannot be reached to trigger the use-after-free. There is no remote vector and no user interaction needed once System access is held (AV:L/PR:H/UI:N). Exploitation is further limited to devices using the affected MediaTek chipsets (including MT6897, MT6899, MT6989, MT6991, MT8196, MT8678 and the other listed MT-series SoCs) running firmware prior to the fix (Patch ID ALPS11076799); non-MediaTek devices and patched builds are not affected. This is a privilege-escalation link that presupposes a prior compromise, so it is most relevant as the second stage of an exploit chain.

This is a moderate-priority, defense-in-depth issue rather than a high-urgency flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7, MEDIUM) is internally consistent with the description: it is a local-only use-after-free in MediaTek's apusys (AI Processing Unit) driver, and exploitation explicitly requires that the attacker already hold System privilege, which is why PR:H is correct. The high C/I/A impacts reflect a kernel-level memory-corruption primitive, so the realistic value to an attacker is crossing the System-to-kernel boundary, not initial compromise. No EPSS score was supplied in the input, and the CVE is not listed in CISA KEV, with no public exploit code referenced - so there is no public exploit identified at time of analysis. The signals do not conflict: a local, high-privilege prerequisite with no exploitation evidence aligns with a vulnerability that is serious in a privilege-escalation chain but not a mass-exploitation candidate. SSVC framing would likely be exploitation=none, automatable=no (requires pre-existing System access and local presence), technical impact=total (kernel memory corruption). The main caveat is the absence of EPSS/SSVC data in the input, so those dimensions are inferred from the CVSS vector rather than confirmed.

A malicious app or local process that has already achieved the Android System privilege (uid system) issues crafted calls to the apusys driver interface, triggering a use-after-free on a freed kernel object. By grooming kernel heap allocations around the dangling pointer, the attacker turns the dangling reference into a kernel read/write primitive and escalates from System to full kernel/root. No user interaction is required, but no public proof-of-concept exploit was identified in the provided data.