CVE-2026-20531

CVE-2026-20531 is a use-after-free (CWE-416) in MediaTek's APU (AI processing unit) that can corrupt memory. A local attacker can trigger it with no additional privileges and no user interaction, and successful exploitation yields local privilege escalation. Devices running the affected MediaTek APU firmware are impacted; MediaTek assigned patch ID ALPS11249016 and issue ID MSV-9169. No CVSS score is published in the supplied data, the flaw is not in CISA KEV, and no public proof-of-concept is known. Exploitation in the wild is not known.

What to do: Install the OEM or carrier firmware update that includes MediaTek patch ALPS11249016 (issue MSV-9169) as soon as it is offered. Until then, avoid installing untrusted local apps, because the bug is a local privilege escalation that needs no user interaction and no extra privileges. No public proof-of-concept is known and there is no sign of in-the-wild exploitation.