CVE-2026-20478
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Audio HAL, a heap buffer overflow could lead to an out-of-bounds write, causing local denial of service. User execution privileges are required, but no user interaction is needed.
Risk Assessment
A user with basic privileges could crash audio services, disrupting system functionality.
Recommendation
Apply patch ALPS10981454 (for MT6880, MT6890, MT6988, MT6990) or AUTO00851293 (for MT2735, MT2737).
Other vulnerabilities in Audio HAL
See all- CVE-2026-20492Medium
In Audio HAL, there is a possible system unresponsiveness due to a race condition. This could lead to local denial of service, requiring User execution privileges. User interaction is not required for exploitation.
- CVE-2026-20480Medium
In Audio HAL, a heap buffer overflow could lead to an out-of-bounds write, causing local denial of service. User execution privileges are required, but no user interaction is needed.
Original NVD description (English source)
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981454 (Note: For MT6880, MT6890, MT6988, MT6990) / AUTO00851293 (Note: For MT2735, MT2737); Issue ID: MSV-7638.