CVE-2026-20508: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in MediaTek, Inc. MediaTek chipset

This vulnerability involves a type confusion flaw (CWE-843) in the Power HAL of MediaTek chipsets. An attacker with existing System privileges can exploit this flaw to escalate privileges locally. The issue does not require user interaction to be exploited. The vulnerability affects a wide range of MediaTek chipset versions, including MT2718, MT6739, MT6761, MT6765, MT6768, MT6769, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6858, MT6877, MT6878, MT6879, MT6881, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8171, MT8186, MT8188, MT8189, MT8196, MT8668, MT8676, MT8678, MT8696, and MT8793. The CVSS v3.1 base score is 6.7 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Successful exploitation can lead to local escalation of privilege, allowing an attacker with System privileges to gain higher privileges. Confidentiality, integrity, and availability impacts are all rated high per the CVSS vector. However, exploitation requires prior System privilege access, limiting the initial attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided data references a Patch ID (ALPS11165543) and Issue ID (MSV-9012), but no explicit patch availability or vendor advisory content is included. Users should monitor MediaTek advisories for official fixes and apply them once available.