Executive brief
MediaTek's Audio Hardware Abstraction Layer (HAL) contains a permission validation flaw that allows information disclosure. An attacker who has already gained System-level privileges on a device can read sensitive audio-related data without additional user interaction, potentially exposing system state, configuration, or audio stream metadata.
Technical details
This vulnerability is a missing permission check in the Audio HAL component, allowing unauthorized information access (CWE class: authorization/permission bypass). The root cause is insufficient validation of caller permissions before exposing sensitive audio subsystem data. The attack vector is local; the attacker must already possess System privilege. No user interaction is required for exploitation. A successful exploit allows an authenticated local attacker to disclose sensitive information from the audio HAL, which may reveal system configuration or operational state. Patch ALPS11087632 addresses this issue.
Affected products
- MediaTek Audio HAL Unknown
Timeline
- 2026-09-07: disclosed