CVE-2026-20411
NixOS vulnerability analysis and mitigation

Overview

CVE-2026-20411 is a use-after-free vulnerability in the MediaTek cameraisp (camera image signal processor) component that can lead to local privilege escalation or denial of service. It affects Android versions 13.0, 14.0, 15.0, and 16.0 running on a wide range of MediaTek chipsets (MT6878, MT6879, MT6881, MT6886, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8188, MT8195, MT8365, MT8370, MT8390, MT8395, MT8666, MT8667, MT8673, MT8676, MT8793). The vulnerability was published on February 2, 2026, with a patch made available via the MediaTek February 2026 Product Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (MediaTek Bulletin, Red Hat CVE).

Technical details

The vulnerability is classified as CWE-416 (Use After Free) and resides in the cameraisp kernel driver component on MediaTek-powered Android devices. A local attacker who has already obtained System-level privileges can trigger the use-after-free condition, potentially allowing further privilege escalation or causing a local denial of service. Exploitation requires low privileges and no user interaction, and the attack vector is local. The patch is identified as Patch ID: ALPS10351676; Issue ID: MSV-5737 (MediaTek Bulletin).

Impact

Successful exploitation can result in high impacts to confidentiality, integrity, and availability on the affected device. An attacker with System-level privileges could leverage this flaw to escalate privileges further within the device or cause a local denial of service by corrupting kernel memory through the freed pointer. The scope is limited to the local device; however, on a compromised device, this could facilitate deeper system access or persistent control (MediaTek Bulletin).

Mitigation and workarounds

MediaTek has released a patch (Patch ID: ALPS10351676; Issue ID: MSV-5737) addressing this vulnerability, available through the MediaTek February 2026 Product Security Bulletin. Device manufacturers (OEMs) and carriers should integrate and distribute the patched firmware to affected Android 13.0, 14.0, 15.0, and 16.0 devices running vulnerable MediaTek chipsets. As a risk-reduction measure, organizations should restrict System-level privilege assignments where operationally feasible to limit the attack surface until patches are deployed (MediaTek Bulletin).

Community reactions

Coverage of CVE-2026-20411 has been limited to automated vulnerability tracking platforms and aggregators such as Vulners, VulDB, and CVEFeed, with no notable independent researcher commentary or significant media coverage identified. The Hacker Wire published a brief entry on the vulnerability shortly after disclosure (MediaTek Bulletin).

Additional resources


SourceThis report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-68981HIGH8.8
  • NixOS logoNixOS
  • cpe:2.3:a:apache:nifi
NoYesAug 03, 2026
CVE-2026-69153MEDIUM6.3
  • JavaScript logoJavaScript
  • pcs
NoYesAug 03, 2026
CVE-2026-68979MEDIUM5.9
  • NixOS logoNixOS
  • cpe:2.3:a:apache:nifi
NoYesAug 03, 2026
CVE-2026-68980LOW2.3
  • NixOS logoNixOS
  • cpe:2.3:a:apache:nifi
NoYesAug 03, 2026
CVE-2026-54522LOW2.1
  • Ruby logoRuby
  • ruby4.0-msgpack
NoYesJul 30, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management