MediaTek aidl Use-After-Free and Permission Flaws

A missing permission check in the MediaTek AIDL (Android Interface Definition Language) component allows an attacker who already holds the Android System privilege to escalate to higher privileges locally, with no user interaction required. The expected impact is high across confidentiality, integrity, and availability (CVSS 3.1 base 6.7, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but the local-only vector and the PR:H precondition mean an ordinary unprivileged app cannot trigger it directly - it is only useful as a second-stage step in an existing exploit chain or for already-privileged malware. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); this is a moderate, defense-in-depth issue rather than a top-tier emergency.

Local privilege escalation in the aidl component shipped on a defined set of MediaTek chipsets (MT6899, MT6991, MT8910, MT8781, MT6881, MT8668, MT6989, MT8188, MT6878, MT6993, MT8695, MT8189, MT8696) allows a process that already holds Android System privilege to trigger a use-after-free, corrupt memory, and gain higher-integrity code execution with high confidentiality, integrity, and availability impact. The attack is local (AV:L) and needs no user interaction, but the PR:H prerequisite means it cannot be used for initial access and only functions as a follow-on escalation from an already-compromised privileged context. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS data was not supplied for this CVE. MediaTek has published a fix under Patch ID ALPS11242428 in its October 2026 Product Security Bulletin.

Local privilege escalation in MediaTek AIDL on affected chipsets is possible via a use-after-free memory corruption, but only after an attacker has already obtained Android System privilege and local access. Successful exploitation requires no user interaction and can yield high confidentiality, integrity, and availability impact within that privileged context. No public exploit identified at time of analysis; the vendor patch ID ALPS11185225 and the October 2026 MediaTek security bulletin address the issue.