CVE-2026-20542: CWE-416 Use After Free in MediaTek, Inc. MediaTek chipset

This vulnerability involves a use-after-free flaw (CWE-416) in the apusys component of MediaTek chipsets. The flaw can cause memory corruption that may allow a local attacker with existing System privileges to escalate their privileges further. No user interaction is required for exploitation. The affected chipsets include a range of MediaTek models such as MT2718, MT6878, MT6897, MT6899, MT6989, MT6991, MT8171, MT8188, MT8189, MT8196, MT8370, MT8371, MT8390, MT8391, MT8395, MT8678, MT8792, MT8793, and MT8796. A patch is referenced by Patch ID ALPS11076799, but no explicit patch availability or vendor advisory content is provided in the input.

Successful exploitation can lead to local escalation of privilege on affected MediaTek chipsets if the attacker already has System privileges. This could allow the attacker to gain higher privileges or execute unauthorized actions within the system. There is no indication of remote exploitation or requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The input references a Patch ID (ALPS11076799), suggesting a fix may exist, but no explicit confirmation is provided. Until official guidance is available, affected users should monitor vendor communications for updates and apply patches once released.