CVE-2026-20492
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
In Audio HAL, there is a possible system unresponsiveness due to a race condition. This could lead to local denial of service, requiring User execution privileges. User interaction is not required for exploitation.
Risk Assessment
The risk involves potential system hangs, which could disrupt audio applications and affect user productivity.
Recommendation
It is recommended to immediately apply patches ALPS10960026 (for MT6880, MT6890, MT6990, MT6988) and AUTO00851250 (for MT2735, MT2737).
Other vulnerabilities in Audio HAL
See all- CVE-2026-20514Medium
In Audio HAL, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed.
- CVE-2026-20513Medium
In Audio HAL, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed.
- CVE-2026-20512Medium
In Audio HAL, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed.
- CVE-2026-20507Medium
In Audio HAL, there is a possible escalation of privilege due to use-after-free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed.
- CVE-2026-20506Medium
In Audio HAL, there is a possible escalation of privilege due to use-after-free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed.
- CVE-2026-20480Medium
In Audio HAL, a heap buffer overflow could lead to an out-of-bounds write, causing local denial of service. User execution privileges are required, but no user interaction is needed.
- CVE-2026-20478Medium
In Audio HAL, a heap buffer overflow could lead to an out-of-bounds write, causing local denial of service. User execution privileges are required, but no user interaction is needed.
Original NVD description (English source)
In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960026 (Note: For MT6880, MT6890, MT6990, MT6988) / AUTO00851250 (Note: For MT2735, MT2737); Issue ID: MSV-7583.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

