CVE-2026-20524

CVE-2026-20524 is a memory-corruption flaw in MediaTek’s APU (AI Processing Unit) caused by improper validation of an input index, position, or offset (CWE-1285). A local attacker can trigger it with no extra privileges and without user interaction. Successful exploitation can escalate privileges on the device. Affected chipsets and firmware versions are not listed; MediaTek tracks the fix as patch ALPS11249004 (issue MSV-9170), part of a broader set of modem, video, and AI component fixes. It is not on the CISA KEV list, no public proof-of-concept is known, and CVSS has not yet been scored.

What to do: Install the OEM or device firmware update that includes MediaTek patch ALPS11249004 (issue MSV-9170) as soon as it is offered for your model. Until then, treat this as a local privilege-escalation issue: limit who can run code on the device and avoid sideloading untrusted apps. Check MediaTek’s security bulletin for the chipset list tied to this patch; no public workaround is described in the advisory data.