CVE-2026-20411

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20411", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "state": "PUBLISHED", "assignerShortName": "MediaTek", "dateReserved": "2025-11-03T01:30:59.008Z", "datePublished": "2026-02-02T08:15:03.859Z", "dateUpdated": "2026-03-30T13:03:06.262Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:03:06.262Z"}, "descriptions": [{"lang": "en", "value": "In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5737."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "defaultStatus": "unaffected", "versions": [{"version": "MT6878", "status": "affected"}, {"version": "MT6879", "status": "affected"}, {"version": "MT6881", "status": "affected"}, {"version": "MT6886", "status": "affected"}, {"version": "MT6895", "status": "affected"}, {"version": "MT6897", "status": "affected"}, {"version": "MT6899", "status": "affected"}, {"version": "MT6983", "status": "affected"}, {"version": "MT6985", "status": "affected"}, {"version": "MT6989", "status": "affected"}, {"version": "MT6991", "status": "affected"}, {"version": "MT6993", "status": "affected"}, {"version": "MT8168", "status": "affected"}, {"version": "MT8188", "status": "affected"}, {"version": "MT8195", "status": "affected"}, {"version": "MT8365", "status": "affected"}, {"version": "MT8370", "status": "affected"}, {"version": "MT8390", "status": "affected"}, {"version": "MT8395", "status": "affected"}, {"version": "MT8666", "status": "affected"}, {"version": "MT8667", "status": "affected"}, {"version": "MT8673", "status": "affected"}, {"version": "MT8676", "status": "affected"}, {"version": "MT8793", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-20411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T04:55:53.751584Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:38.529Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-20411", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-03T04:55:53.751584Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T18:29:16.789Z"}}], "cna": {"affected": [{"vendor": "MediaTek, Inc.", "product": "MediaTek chipset", "versions": [{"status": "affected", "version": "MT6878"}, {"status": "affected", "version": "MT6879"}, {"status": "affected", "version": "MT6881"}, {"status": "affected", "version": "MT6886"}, {"status": "affected", "version": "MT6895"}, {"status": "affected", "version": "MT6897"}, {"status": "affected", "version": "MT6899"}, {"status": "affected", "version": "MT6983"}, {"status": "affected", "version": "MT6985"}, {"status": "affected", "version": "MT6989"}, {"status": "affected", "version": "MT6991"}, {"status": "affected", "version": "MT6993"}, {"status": "affected", "version": "MT8168"}, {"status": "affected", "version": "MT8188"}, {"status": "affected", "version": "MT8195"}, {"status": "affected", "version": "MT8365"}, {"status": "affected", "version": "MT8370"}, {"status": "affected", "version": "MT8390"}, {"status": "affected", "version": "MT8395"}, {"status": "affected", "version": "MT8666"}, {"status": "affected", "version": "MT8667"}, {"status": "affected", "version": "MT8673"}, {"status": "affected", "version": "MT8676"}, {"status": "affected", "version": "MT8793"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5737."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2026-03-30T13:03:06.262Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20411", "state": "PUBLISHED", "dateUpdated": "2026-03-30T13:03:06.262Z", "dateReserved": "2025-11-03T01:30:59.008Z", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "datePublished": "2026-02-02T08:15:03.859Z", "assignerShortName": "MediaTek"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaTek chipset", "vendor": "MediaTek, Inc.", "versions": [{"status": "affected", "version": "MT6878"}, {"status": "affected", "version": "MT6879"}, {"status": "affected", "version": "MT6881"}, {"status": "affected", "version": "MT6886"}, {"status": "affected", "version": "MT6895"}, {"status": "affected", "version": "MT6897"}, {"status": "affected", "version": "MT6899"}, {"status": "affected", "version": "MT6983"}, {"status": "affected", "version": "MT6985"}, {"status": "affected", "version": "MT6989"}, {"status": "affected", "version": "MT6991"}, {"status": "affected", "version": "MT6993"}, {"status": "affected", "version": "MT8168"}, {"status": "affected", "version": "MT8188"}, {"status": "affected", "version": "MT8195"}, {"status": "affected", "version": "MT8365"}, {"status": "affected", "version": "MT8370"}, {"status": "affected", "version": "MT8390"}, {"status": "affected", "version": "MT8395"}, {"status": "affected", "version": "MT8666"}, {"status": "affected", "version": "MT8667"}, {"status": "affected", "version": "MT8673"}, {"status": "affected", "version": "MT8676"}, {"status": "affected", "version": "MT8793"}]}], "source": "security@mediatek.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:13.0:*:*:*:*:*:*:*", "matchCriteriaId": "879FFD0C-9B38-4CAA-B057-1086D794D469", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:14.0:*:*:*:*:*:*:*", "matchCriteriaId": "2700BCC5-634D-4EC6-AB67-5B678D5F951D", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:15.0:*:*:*:*:*:*:*", "matchCriteriaId": "8538774C-906D-4B03-A3E7-FA7A55E0DA9E", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:16.0:-:*:*:*:*:*:*", "matchCriteriaId": "02882AB1-7993-47DD-84A0-8DF4272D85ED", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:mt6878:-:*:*:*:*:*:*:*", "matchCriteriaId": "855A8046-34ED-4891-ACE5-76AB10AC8D53", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6879:-:*:*:*:*:*:*:*", "matchCriteriaId": "704BE5CE-AE08-4432-A8B0-4C8BD62148AD", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6881:-:*:*:*:*:*:*:*", "matchCriteriaId": "9F7C1B31-4E33-4939-A926-79FE401368CB", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6886:-:*:*:*:*:*:*:*", "matchCriteriaId": "AF3E2B84-DAFE-4E11-B23B-026F719475F5", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6895:-:*:*:*:*:*:*:*", "matchCriteriaId": "E0CA45C9-7BFE-4C93-B2AF-B86501F763AB", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6897:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A7D8055-F4B6-41EE-A078-11D56285AB66", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6899:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6E9F80F-9AC9-41E0-BB14-9DB6F14B62CD", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6983:-:*:*:*:*:*:*:*", "matchCriteriaId": "EB6B9A26-F8A1-4322-AA4E-CDF8F7D99000", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6985:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA72CCD1-DEA2-48EB-8781-04CFDD41AAEE", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6989:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD7DE6B2-66D9-4A3E-B15F-D56505559255", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6991:-:*:*:*:*:*:*:*", "matchCriteriaId": "CBBB30DF-E963-4940-B742-F6801F68C3FC", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt6993:-:*:*:*:*:*:*:*", "matchCriteriaId": "57E92BE0-5E65-4770-8E1A-0E5D07A38164", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8168:-:*:*:*:*:*:*:*", "matchCriteriaId": "3CE2FC35-716A-4706-97BA-5DB165041580", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8188:-:*:*:*:*:*:*:*", "matchCriteriaId": "BA3D4A45-38EE-4125-AE67-89D1C707F95A", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8195:-:*:*:*:*:*:*:*", "matchCriteriaId": "ED210E64-6CE7-42B1-849E-68C0E22521F6", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8365:-:*:*:*:*:*:*:*", "matchCriteriaId": "97C76F98-5D8D-4E52-ABAF-CD27C1205B0E", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8370:-:*:*:*:*:*:*:*", "matchCriteriaId": "DA2B6BB9-7544-41A7-BF3A-344AA4CC4B31", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8390:-:*:*:*:*:*:*:*", "matchCriteriaId": "B774B7D7-B7DD-43A0-833F-7E39DF82CA60", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8395:-:*:*:*:*:*:*:*", "matchCriteriaId": "D98FBE1C-D57B-49D9-9C4E-8A133A0C1C89", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8666:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C9AB4D2-0EDD-4D5E-9393-F535CA2F24C4", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8667:-:*:*:*:*:*:*:*", "matchCriteriaId": "2FE14B46-C1CA-465F-8578-059FA2ED30EB", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8673:-:*:*:*:*:*:*:*", "matchCriteriaId": "152F6606-FA23-4530-AA07-419866B74CB3", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8676:-:*:*:*:*:*:*:*", "matchCriteriaId": "EE302F6F-170E-4350-A8F4-65BE0C50CB78", "vulnerable": false}, {"criteria": "cpe:2.3:h:mediatek:mt8793:-:*:*:*:*:*:*:*", "matchCriteriaId": "2FBD3487-F8CE-406C-8BD7-DD57FF8CD60B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5737."}, {"lang": "es", "value": "En cameraisp, existe una posible escalada de privilegios debido a un uso despu\u00e9s de liberaci\u00f3n. Esto podr\u00eda conducir a una denegaci\u00f3n de servicio local si un actor malicioso ya ha obtenido el privilegio de Sistema. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n. ID del parche: ALPS10351676; ID del problema: MSV-5737."}], "id": "CVE-2026-20411", "lastModified": "2026-06-17T10:17:22.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20411", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T04:55:53.751584Z", "version": "2.0.3"}}]}, "published": "2026-02-02T09:15:56.040", "references": [{"source": "security@mediatek.com", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/February-2026"}], "sourceIdentifier": "security@mediatek.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security@mediatek.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T07:10:17.667824+00:00", "value": {"mitigation_remediation": ["Apply the official MediaTek firmware patch identified by ALPS10351676 to address the use\u2011after\u2011free in cameraisp.", "If an update is not yet available, limit the cameraisp service\u2019s permissions so that only privileged processes can access it, thereby preventing unprivileged local users from triggering the flaw.", "Verify that memory deallocation routines in cameraisp consistently clear or nullify pointers after a free operation, and enforce these practices in future builds to avoid dangling references."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected systems include MediaTek chipsets such as MT6878, MT6879, MT6881, MT6886, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8188, MT8195, MT8365, MT8370, MT8390, MT8395, MT8666, MT8667, MT8673, MT8676, MT8793, and Android platforms ranging from version 13.0 through 16.0 that incorporate these chipsets. These components are found in a range of Android devices supplied by MediaTek.", "description_and_impact": "The vulnerability is a use\u2011after\u2011free in the cameraisp component. It can be triggered when a Free operation leaves a dangling pointer that is subsequently dereferenced by code executing with system privileges. The result is a local denial of service that can crash the cameraisp process or otherwise disable camera functionality. Because the flaw is exploitable only after system privilege has already been achieved, it does not provide an additional elevation of privilege but can render the device non\u2011operational for the user.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high risk, but the EPSS score of less than 1% signifies that exploitation is considered unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local with no user interaction required; an adversary must already possess system privileges to trigger the flaw. If the software is patched, the risk is mitigated, though operators should be aware that the flaw could be leveraged to crash the camera subsystem and disrupt device availability."}}}}, "created": "2026-02-04T12:44:49.111926+00:00", "title": "Use\u2011After\u2011Free in Cameraisp Causes Local Denial of Service on MediaTek Chipsets", "updated": "2026-04-16T07:15:28.173868+00:00", "vendors": ["mediatek", "mediatek$PRODUCT$mt6781", "mediatek$PRODUCT$mt6878", "mediatek$PRODUCT$mt6879", "mediatek$PRODUCT$mt6886", "mediatek$PRODUCT$mt6895", "mediatek$PRODUCT$mt6897", "mediatek$PRODUCT$mt6899", "mediatek$PRODUCT$mt6983", "mediatek$PRODUCT$mt6985", "mediatek$PRODUCT$mt6989", "mediatek$PRODUCT$mt6991", "mediatek$PRODUCT$mt6993", "mediatek$PRODUCT$mt8168", "mediatek$PRODUCT$mt8188", "mediatek$PRODUCT$mt8195", "mediatek$PRODUCT$mt8365", "mediatek$PRODUCT$mt8370", "mediatek$PRODUCT$mt8390", "mediatek$PRODUCT$mt8395", "mediatek$PRODUCT$mt8666", "mediatek$PRODUCT$mt8667", "mediatek$PRODUCT$mt8673", "mediatek$PRODUCT$mt8676", "mediatek$PRODUCT$mt8793"]}