MediaTek MT6899 Firmware: Memory corruption in APU enables local privilege escalation
Summary
A memory corruption flaw caused by improper input validation in the apu component of certain MediaTek chipsets allows local privilege escalation. An attacker must already be able to run code on the device, for example through a malicious app. No user interaction is required, and the flaw cannot be exploited directly over the internet. MediaTek reports no known active exploitation.
Affected
- MediaTek MT6899
- MediaTek MT6993
- MediaTek MT8668
- MediaTek MT8781
- MediaTek MT8793
- MediaTek MT8910 (default: unaffected)
- Affected firmware or software versions: Unknown.
Fixed in
Unknown. Patch ID ALPS11249004 (Issue ID MSV-9170) is listed in the MediaTek October 2026 bulletin. Fixes reach devices only through device makers (OEMs) as firmware or Android security updates.
Workaround
- No vendor workaround known.
- Keep the device security patch level current.
Exploitation
- MediaTek is not aware of active exploitation in the wild.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof-of-concept confirmed.
Our recommendation
- Inventory Android phones, tablets and connected devices that use the affected chipsets.
- Install the OEM security update for each device model as soon as it is available.
- Prioritise shared, BYOD and field devices, and restrict installation of untrusted apps.
- Monitor MediaTek and OEM advisories and verify the security patch level.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MediaTek October 2026 Product Security Bulletin www.mediatek.com
- VulDB CVE-2026-20524 vuldb.com
- SecurityOnline: MediaTek October 2026 bulletin securityonline.info
- GBHackers: MediaTek fixes 31 security flaws gbhackers.com
- CISA ADP Vulnrichment via HOL Guard hol.org
- BreachRoad: MediaTek October 2026 managed device updates breachroad.com
- Vulners NVD record CVE-2026-20524 vulners.com
- TheHackerWire CVE-2026-20524 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:55.
Original description (NVD)
In apu, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249004; Issue ID: MSV-9170.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.