# CVE-2026-20531: MediaTek APU memory corruption use-after-free

Source: https://junglewise.ai/threats/cve-2026-20531-in-apu-there-is-a-possible-memory-corruption-due-to-use-after  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-20531 · Severity: high · CVSS 8.4 · Published 2026-10-05

MediaTek's APU (Audio Processing Unit) component contains a use-after-free memory corruption vulnerability that allows attackers to escalate privileges on affected devices. This could enable code execution with elevated permissions without requiring user interaction. The vulnerability affects numerous MediaTek chipsets used in smartphones and IoT devices worldwide.

Technologies: [MediaTek Mt2716](https://junglewise.ai/threats/technologies/mt2716), [MediaTek MT2735](https://junglewise.ai/threats/technologies/mt2735), [MediaTek MT2737](https://junglewise.ai/threats/technologies/mt2737), [MediaTek MT6813](https://junglewise.ai/threats/technologies/mt6813), [MediaTek Mt6815](https://junglewise.ai/threats/technologies/mt6815), [MediaTek MT6833](https://junglewise.ai/threats/technologies/mt6833), [MediaTek Mt6835](https://junglewise.ai/threats/technologies/mt6835), [MediaTek Mt6853](https://junglewise.ai/threats/technologies/mt6853), [MediaTek Mt6855](https://junglewise.ai/threats/technologies/mt6855), [MediaTek MT6858](https://junglewise.ai/threats/technologies/mt6858), [MediaTek MT6873](https://junglewise.ai/threats/technologies/mt6873), [MediaTek Mt6875](https://junglewise.ai/threats/technologies/mt6875), [MediaTek Mt6877](https://junglewise.ai/threats/technologies/mt6877), [MediaTek Mt6878](https://junglewise.ai/threats/technologies/mt6878), [MediaTek Mt6879](https://junglewise.ai/threats/technologies/mt6879), [MediaTek Mt6880](https://junglewise.ai/threats/technologies/mt6880), [MediaTek Mt6881](https://junglewise.ai/threats/technologies/mt6881), [MediaTek Mt6883](https://junglewise.ai/threats/technologies/mt6883), [MediaTek Mt6885](https://junglewise.ai/threats/technologies/mt6885), [MediaTek Mt6886](https://junglewise.ai/threats/technologies/mt6886), [MediaTek Mt6889](https://junglewise.ai/threats/technologies/mt6889), [MediaTek Mt6890](https://junglewise.ai/threats/technologies/mt6890), [MediaTek MT6891](https://junglewise.ai/threats/technologies/mt6891), [MediaTek Mt6893](https://junglewise.ai/threats/technologies/mt6893), [MediaTek Mt6895](https://junglewise.ai/threats/technologies/mt6895), [MediaTek MT6896](https://junglewise.ai/threats/technologies/mt6896). Vendors: [MediaTek](https://junglewise.ai/threats/vendors/mediatek).

## Quick answers

**Is CVE-2026-20531 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20531 being exploited in the wild.

**How severe is CVE-2026-20531?** High severity, with a CVSS score of 8.4, published 5 October 2026.

**Which products and versions are affected?** MediaTek MT2716; MediaTek MT2735; MediaTek MT2737; MediaTek MT6813; and 22 more.

**Is there a fix for CVE-2026-20531?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20531 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-20531?** Check whether you run MediaTek Mt2716, MediaTek MT2735, MediaTek MT2737 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability in the APU component allows local attackers to achieve memory corruption and escalate privileges. The flaw requires local access but no additional execution privileges, and exploitation does not require user interaction. Affected are multiple MediaTek chipsets across multiple product lines.

## Affected products

- MediaTek MT2716
- MediaTek MT2735
- MediaTek MT2737
- MediaTek MT6813
- MediaTek MT6815
- MediaTek MT6833
- MediaTek MT6835
- MediaTek MT6853
- MediaTek MT6855
- MediaTek MT6858
- MediaTek MT6873
- MediaTek MT6875
- MediaTek MT6877
- MediaTek MT6878
- MediaTek MT6879
- MediaTek MT6880
- MediaTek MT6881
- MediaTek MT6883
- MediaTek MT6885
- MediaTek MT6886
- MediaTek MT6889
- MediaTek MT6890
- MediaTek MT6891
- MediaTek MT6893
- MediaTek MT6895
- MediaTek MT6896

## Timeline

- 2026-10-05: disclosed

## References

- [https://www.mediatek.com/product-security-bulletin/October-2026](https://www.mediatek.com/product-security-bulletin/October-2026)

## Related threats

- [MediaTek ccci out of bounds write](https://junglewise.ai/threats/cve-2026-20552-in-ccci-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek vdec out-of-bounds write in type confusion](https://junglewise.ai/threats/cve-2026-20579-in-vdec-there-is-a-possible-out-of-bounds-write-due-to-type)
- [MediaTek out of bounds write in modem](https://junglewise.ai/threats/cve-2026-20544-in-meta-there-is-a-possible-out-of-bounds-write-due-to-a-missing)
- [MediaTek Modem information disclosure due to logic error](https://junglewise.ai/threats/cve-2026-20543-in-modem-there-is-a-possible-information-disclosure-due-to-a)
- [MediaTek Modem out-of-bounds read due to missing permission check](https://junglewise.ai/threats/cve-2026-20538-in-modem-there-is-a-possible-out-of-bounds-read-due-to-a-missing)