Executive brief
MediaTek's Audio Hardware Abstraction Layer (HAL) contains an input validation flaw that could allow an attacker with system-level privileges to access sensitive information on affected devices. This vulnerability could expose data processed by the audio subsystem, potentially affecting smartphones, smart TVs, and IoT devices that use vulnerable MediaTek chipsets. No user interaction is required once an attacker has gained system-level access.
Technical details
The Audio HAL in MediaTek chipsets suffers from improper input validation that leads to information disclosure. The vulnerability requires the attacker to already possess system (privileged) access, limiting the attack surface to scenarios where device security has already been partially compromised. No user interaction is needed for exploitation once the precondition is met. An attacker with system privilege can leverage this flaw to read sensitive information from memory accessed by the Audio HAL. Patches are available through Patch ID ALPS11087533 and have been distributed to device OEMs for at least two months prior to public disclosure.
Affected products
- MediaTek MT2716 Chipset <UNKNOWN>
- MediaTek MT6835 Chipset <UNKNOWN>
- MediaTek MT6858 Chipset <UNKNOWN>
- MediaTek MT6878 Chipset <UNKNOWN>
- MediaTek MT6881 Chipset <UNKNOWN>
- MediaTek MT6897 Chipset <UNKNOWN>
- MediaTek MT6899 Chipset <UNKNOWN>
- MediaTek MT6982VB Chipset <UNKNOWN>
- MediaTek MT6986 Chipset <UNKNOWN>
- MediaTek MT6988 Chipset <UNKNOWN>
- MediaTek MT6991 Chipset <UNKNOWN>
- MediaTek MT6993 Chipset <UNKNOWN>
- MediaTek MT8668 Chipset <UNKNOWN>
- MediaTek MT8676 Chipset <UNKNOWN>
- MediaTek MT8678 Chipset <UNKNOWN>
- MediaTek MT8755 Chipset <UNKNOWN>
- MediaTek MT8775 Chipset <UNKNOWN>
- MediaTek MT8792 Chipset <UNKNOWN>
- MediaTek MT8793 Chipset <UNKNOWN>
- MediaTek MT8863 Chipset <UNKNOWN>
- MediaTek MT8873 Chipset <UNKNOWN>
- MediaTek MT8883 Chipset <UNKNOWN>
Timeline
- 2026-09-07: disclosed: CVE-2026-20513 published in MediaTek Security Bulletin
- 2026-09-07: patched: Patch ID ALPS11087533 available; OEMs notified at least 2 months prior to public disclosure