CVE-2026-20537: CWE-416 Use After Free in MediaTek, Inc. MediaTek chipset

This vulnerability involves a use-after-free condition in the aidl component of MediaTek chipsets, identified as CWE-416. The flaw can cause memory corruption, potentially allowing a local attacker with existing System privileges to escalate their privileges further. The issue affects specific MediaTek chipset models including MT6878, MT6881, MT6899, MT6989, MT6991, MT6993, MT8188, MT8189, MT8668, MT8781, and MT8910. No CVSS score is provided, and no known exploits in the wild have been reported. A patch is referenced by Patch ID ALPS11185225 and Issue ID MSV-9024, but no direct patch link or vendor advisory content is included in the data.

The vulnerability allows local escalation of privilege through memory corruption caused by use-after-free. This requires the attacker to already have System-level privileges, so it does not enable initial system compromise. There is no requirement for user interaction to exploit this flaw. No evidence of active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Patch ID (ALPS11185225) suggests a fix exists, but no explicit confirmation or vendor advisory content is available in this data. Users of affected MediaTek chipsets should monitor official MediaTek channels for patch availability and apply updates promptly once released.