MediaTek Fixes 31 Security Flaws Affecting Modem, Video and AI Components
MediaTek's October bulletin patches 31 chipset flaws, including two critical modem out-of-bounds writes, with no known exploitation.
64
CVE-2026-20532
Double-free local DoS in MediaTek APU
- CVSS 3.1
- 6.2 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-20532 is a double-free flaw (CWE-415) in MediaTek’s APU component that can crash the application. It is triggered locally with no extra privileges and no user interaction. Impact is limited to local denial of service; the advisory does not describe code execution or remote attack. Affected firmware versions and chipsets are not listed, only patch ALPS11249024 (issue MSV-9168). It is not on the CISA KEV list, has no CVSS score yet, and no public proof-of-concept is known.
What to do: Install the vendor firmware or BSP update that includes MediaTek patch ALPS11249024 (issue MSV-9168) as soon as your device OEM publishes it. Until then, treat untrusted local apps as a crash risk on devices with the affected APU component; there is no public workaround beyond the patch.
| Product | Affected |
|---|---|
| MediaTek APU (AI processing unit) component | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: MSV-9168.
- Vendors
- mediatek
- Products
- mt6899 firmware, mt6993 firmware, mt8668 firmware, mt8781 firmware, mt8910 firmware
- Weakness
- CWE-415
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H