CVE-2026-20517: CWE-416 Use After Free in MediaTek, Inc. MediaTek chipset

This vulnerability (CVE-2026-20517) involves a use-after-free condition in the geniezone component of MediaTek chipsets. A malicious actor who already has System privileges on the device could exploit this flaw to escalate their privileges locally. No user interaction is required for exploitation. The affected chipset models include MT6991, MT8755, MT8768, MT8771, MT8775, MT8781, MT8792, MT8793, MT8796, MT8797, MT8798, MT8799, MT8873, MT8883, MT8893, and MT8910. The CVSS v3.1 base score is 6.7, reflecting a medium severity with high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to local escalation of privilege on affected MediaTek chipsets, potentially allowing an attacker with System privileges to gain higher privileges. This could compromise the confidentiality, integrity, and availability of the system. However, exploitation requires the attacker to already have System-level access, limiting the initial attack vector.

A patch identified as ALPS10900510 addresses this vulnerability. Users and administrators should apply the official patch from MediaTek to remediate this issue. Since this is not a cloud service, remediation depends on deploying the patch to affected devices. No information is provided about temporary mitigations or workarounds. Patch status is confirmed by the patch ID, indicating an official fix is available.