CVE-2026-20510: CWE-415 Double Free in MediaTek, Inc. MediaTek chipset

This vulnerability involves a double free condition (CWE-415) in the camera middleware component of MediaTek chipsets. A double free can cause memory corruption, potentially allowing an attacker with existing System privileges to escalate their privileges further locally. No user interaction is required for exploitation. The issue is tracked under Patch ID ALPS11134622 and Issue ID MSV-8894. The CVSS v3.1 vector is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker who already has System privileges on a vulnerable MediaTek chipset could exploit this double free vulnerability to escalate their privileges further locally. This could lead to full compromise of the affected device's confidentiality, integrity, and availability. However, exploitation requires prior System-level access, limiting the initial attack surface.

A patch identified as ALPS11134622 addresses this vulnerability. Users and vendors should apply this official fix to affected MediaTek chipsets. Since this is not a cloud service, remediation depends on device manufacturers integrating the patch into firmware updates. Patch status beyond the patch ID is not explicitly confirmed; check vendor advisories for current update availability.