CVE-2026-20573
Received Received - Intake

Memory Corruption Due to Double Free in Afe

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: MediaTek, Inc.

Description
In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-20573

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a memory corruption issue caused by a double free in the afe component. This occurs when memory is freed twice, leading to potential system instability or crashes. An attacker with System privilege could exploit this to escalate privileges locally without requiring user interaction.

Impact Analysis

If you are using a device with a MediaTek chipset affected by this vulnerability, an attacker who already has System privilege could exploit it to gain higher privileges on your device. This could allow them to take control of your device, install malicious software, or access sensitive data.

Mitigation Strategies

Apply the patch identified as ALPS11431412 immediately to address the double free vulnerability. Ensure all MediaTek chipset devices are updated to the latest firmware version to prevent potential local privilege escalation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...