Quick answers
- Is CVE-2026-20515 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20515 being exploited in the wild.
- How severe is CVE-2026-20515?
- Medium severity, with a CVSS score of 5.5, published 7 September 2026.
- Which products and versions are affected?
- MediaTek Mt6835 Unspecified; MediaTek MT6858 Unspecified; MediaTek Mt6878 Unspecified; MediaTek Mt6881 Unspecified; and 17 more.
- Is there a fix for CVE-2026-20515?
- A patch was published on 2026-07-07: Patch available at least two months before disclosure (Patch ID: ALPS11122991) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20515 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2026-20515?
- Check whether you run MediaTek Mt6835, MediaTek MT6858, MediaTek Mt6878 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a use-after-free flaw in the GPU driver component affecting multiple MediaTek chipsets. The root cause involves memory management where freed GPU memory objects are accessed after deallocation, potentially leading to system crashes and local information disclosure. Exploitation requires local access with user-level execution privileges and user interaction. An attacker can trigger the flaw to crash the system or leak sensitive data from freed memory regions. MediaTek has released security patches (Patch ID: ALPS11122991) and notified device OEMs at least two months prior to public disclosure; patches should be available through device manufacturers.
Affected products
- MediaTek MT6835 Unspecified
- MediaTek MT6858 Unspecified
- MediaTek MT6878 Unspecified
- MediaTek MT6881 Unspecified
- MediaTek MT6897 Unspecified
- MediaTek MT6899 Unspecified
- MediaTek MT6982VB Unspecified
- MediaTek MT6986 Unspecified
- MediaTek MT6988 Unspecified
- MediaTek MT6991 Unspecified
- MediaTek MT6993 Unspecified
- MediaTek MT8668 Unspecified
- MediaTek MT8676 Unspecified
- MediaTek MT8678 Unspecified
- MediaTek MT8755 Unspecified
- MediaTek MT8775 Unspecified
- MediaTek MT8792 Unspecified
- MediaTek MT8793 Unspecified
- MediaTek MT8863 Unspecified
- MediaTek MT8873 Unspecified
- MediaTek MT8883 Unspecified
Timeline
- 2026-09-07: disclosed: Publicly disclosed via MediaTek Product Security Bulletin
- 2026-07-07: patched: Patch available at least two months before disclosure (Patch ID: ALPS11122991)