CVE-2026-20512: CWE-307 Improper Restriction of Excessive Authentication Attempts in MediaTek, Inc. MediaTek chipset

This vulnerability (CVE-2026-20512) in MediaTek chipsets arises from improper restriction of excessive authentication attempts (CWE-307) within the Audio HAL. It allows a local attacker, who already has System privilege, to escalate their privileges further by exploiting improper input validation. No user interaction is required for exploitation. The issue is tracked under Patch ID ALPS11087540 and Issue ID MSV-8246. The CVSS 3.1 base score is 6.7 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector with low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability.

An attacker with existing System privileges on a vulnerable MediaTek chipset can escalate their privileges further, potentially gaining higher control over the system. This can lead to full compromise of confidentiality, integrity, and availability of the affected system components related to the Audio HAL.

A patch identified as ALPS11087540 addresses this vulnerability. Users and vendors should apply this official fix to affected MediaTek chipsets. Since this is not a cloud service, remediation depends on device manufacturers integrating the patch into firmware updates. Patch status is confirmed by the vendor advisory information.