CVE-2026-20411: 
NixOS vulnerability analysis and mitigation

CVE-2026-20411 is a use-after-free vulnerability in the MediaTek cameraisp (camera image signal processor) component that can lead to local privilege escalation or denial of service. It affects Android versions 13.0, 14.0, 15.0, and 16.0 running on a wide range of MediaTek chipsets (MT6878, MT6879, MT6881, MT6886, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT6993, MT8168, MT8188, MT8195, MT8365, MT8370, MT8390, MT8395, MT8666, MT8667, MT8673, MT8676, MT8793). The vulnerability was published on February 2, 2026, with a patch made available via the MediaTek February 2026 Product Security Bulletin. It carries a CVSS v3.1 base score of 7.8 (High) (MediaTek Bulletin, Red Hat CVE).

The vulnerability is classified as CWE-416 (Use After Free) and resides in the cameraisp kernel driver component on MediaTek-powered Android devices. A local attacker who has already obtained System-level privileges can trigger the use-after-free condition, potentially allowing further privilege escalation or causing a local denial of service. Exploitation requires low privileges and no user interaction, and the attack vector is local. The patch is identified as Patch ID: ALPS10351676; Issue ID: MSV-5737 (MediaTek Bulletin).

Successful exploitation can result in high impacts to confidentiality, integrity, and availability on the affected device. An attacker with System-level privileges could leverage this flaw to escalate privileges further within the device or cause a local denial of service by corrupting kernel memory through the freed pointer. The scope is limited to the local device; however, on a compromised device, this could facilitate deeper system access or persistent control (MediaTek Bulletin).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of publication. The vulnerability requires the attacker to already possess System-level privileges on the target device, which significantly limits the attack surface. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (MediaTek Bulletin).

MediaTek has released a patch (Patch ID: ALPS10351676; Issue ID: MSV-5737) addressing this vulnerability, available through the MediaTek February 2026 Product Security Bulletin. Device manufacturers (OEMs) and carriers should integrate and distribute the patched firmware to affected Android 13.0, 14.0, 15.0, and 16.0 devices running vulnerable MediaTek chipsets. As a risk-reduction measure, organizations should restrict System-level privilege assignments where operationally feasible to limit the attack surface until patches are deployed (MediaTek Bulletin).

Coverage of CVE-2026-20411 has been limited to automated vulnerability tracking platforms and aggregators such as Vulners, VulDB, and CVEFeed, with no notable independent researcher commentary or significant media coverage identified. The Hacker Wire published a brief entry on the vulnerability shortly after disclosure (MediaTek Bulletin).