CVE-2026-20542

CVE-2026-20542 is a use-after-free (CWE-416) in MediaTek apusys, the vendor’s AI processing unit subsystem, that can corrupt memory. A local attacker who already has System privilege can trigger it without any user interaction and escalate privileges further. It does not, by itself, give a remote or unprivileged attacker a foothold. MediaTek assigned the issue (patch ALPS11076799, issue MSV-8143) as part of a broader set of modem, video, and AI fixes, but the public description does not list chipsets or version ranges. It is not in CISA’s Known Exploited Vulnerabilities catalog, has no published CVSS score yet, and no public proof-of-concept is known.

What to do: Install the OEM or carrier Android security update that includes MediaTek patch ALPS11076799 (issue MSV-8143) as soon as it is offered for your device. Until then, treat this as a post-compromise issue: it only matters after an attacker already has System privilege, so keep devices patched against earlier local exploits and avoid sideloading untrusted apps. There is no public fixed version string in this advisory, so confirm the patch via your device maker rather than a generic version number.