CVE-2026-20515

Use‑After‑Free in MediaTek GPU Driver Leading to Local Information Disclosure

View on CVE.org
Published Sep 7, 2026 CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Description
In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11122991; Issue ID: MSV-8132.

Analysis

AI-generated

Technical impact

The vulnerability is a use‑after‑free (CWE-416) in the MediaTek GPU driver that can cause a system crash and may disclose local information. It requires user execution privileges and user interaction to be triggered.

Affected Systems

MediaTek Inc. chipset GPU components. No specific firmware or kernel versions are listed in the advisory.

Risk and Exploitability

The EPSS score is 0.00159, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score is 5. It is not publicly exploited at present. Exploitation requires local user privilege and user interaction, and the impact is limited to the local system without offering remote code execution.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑provided patch ALPS11122991 to the MediaTek GPU firmware.
  • Reboot the device to ensure the patch is fully integrated.
  • Limit GPU usage to trusted applications or disable GPU acceleration if feasible.

Generated by OpenCVE AI on November 2, 2026 at 20:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Use‑After‑Free in MediaTek GPU Driver Leading to Local Information Disclosure
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}
Type Values Removed Values Added
Title Use-After-Free in MediaTek GPU May Crash System and Leak Sensitive Data
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mediatek, Inc.
Mediatek, Inc. mediatek Chipset
Vendors & Products Mediatek, Inc.
Mediatek, Inc. mediatek Chipset
Type Values Removed Values Added
Title Use-After-Free in MediaTek GPU May Crash System and Leak Sensitive Data
Type Values Removed Values Added
Description In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11122991; Issue ID: MSV-8132.
Weaknesses CWE-416
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
MediaTek
Published
Updated
Nov 2, 2026, 5:07 PM
Reserved
Nov 3, 2025, 1:30 AM

View source JSON

Updated
Sep 7, 2026, 10:24 AM

JSON

Status
Deferred
Published
Sep 7, 2026, 2:17 AM
Modified
Nov 2, 2026, 5:17 PM

View source JSON

No data.

Updated
Nov 2, 2026, 8:45 PM

JSON