MediaTek apu Memory Corruption and Privilege Escalation

Local privilege escalation in the MediaTek APU (AI Processing Unit) driver allows an attacker with existing code execution on affected devices to trigger a use-after-free, achieving full compromise of confidentiality, integrity, and availability (CVSS 8.4). The flaw affects MediaTek chipsets MT8781, MT6993, MT6899, MT8668, MT8910, and MT8793, and requires no additional privileges or user interaction once local access is obtained. No public exploit code or active exploitation is confirmed at time of analysis.

Local privilege escalation in MediaTek's APU (AI Processing Unit) allows a locally-executing attacker to corrupt memory via malformed input, potentially achieving kernel-level code execution on devices with affected chipsets (MT6899, MT8781, MT8910, MT8793, MT6993, MT8668). The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires the attacker to already run code on the device, such as a malicious Android app, with no additional privileges or user interaction needed. No public exploit identified at time of analysis, and the flaw is fixed by MediaTek patch ALPS11249004.

A double-free flaw in MediaTek's AI Processing Unit (APU) component allows a locally executing attacker - such as a malicious or compromised installed application - to crash an affected device, producing a local denial of service. Per the assessed CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication, elevated privileges, or user interaction are required once local code execution is achieved, and the impact is limited to availability; there is no data exposure or code-execution gain from this defect. Exploitation is confined to devices built on the enumerated MediaTek chipsets (MT8781, MT6899, MT8668, MT8910, MT6993) running unpatched firmware; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).