CVE-2026-20506: CWE-416 Use After Free in MediaTek, Inc. MediaTek chipset

This vulnerability (CVE-2026-20506) involves a use-after-free condition in the Audio Hardware Abstraction Layer (HAL) of MediaTek chipsets. An attacker with existing System privileges could exploit this flaw to escalate their privileges locally. The flaw does not require user interaction to be exploited. The issue is tracked under Patch ID ALPS11191981 and Issue ID MSV-9126. The affected chipsets include a broad range of MediaTek models such as MT2718, MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8126, MT8168, MT8171, MT8186, MT8188, MT8189, MT8196, MT8321, MT8365, MT8367, MT8385, MT8390, MT8391, MT8668, MT8676, MT8678, MT8696, MT8755, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8792, MT8796, MT8797, MT8798, MT8799, MT8873, MT8883, MT8893, and MT8910. No known exploits are reported in the wild.

The vulnerability allows a local attacker who already has System privileges to escalate their privileges further via a use-after-free in the Audio HAL. This could lead to complete compromise of the affected system's confidentiality, integrity, and availability. No user interaction is required for exploitation, increasing the risk in environments where an attacker has some level of access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue is tracked under Patch ID ALPS11191981; however, no explicit patch links or official fix confirmation are provided in the available data. Users and administrators should monitor MediaTek advisories for updates and apply patches once available.