Mediatek Chipset CVE-2026-20446

Multiple risk indicators converge on a low practical threat level: the CVSS vector indicates physical attack vector (AV:P) combined with low privilege requirements (PR:L), the EPSS score of 0.02% at the 6th percentile shows minimal exploitation likelihood, CISA SSVC framework rates exploitation as 'none' with partial technical impact, and no evidence of public exploit code or active KEV status exists. While CWE-787 (out-of-bounds write) is generally a serious memory corruption class, the physical access requirement and local privilege prerequisite effectively limit this to insider threats, hardware tampering, or supply chain attack scenarios. This is a real vulnerability but represents a lower priority for patch deployment in most enterprise or consumer deployments unless physical security controls are already compromised.

An attacker with physical access to a MediaTek MT6813-based device and local user-level account credentials could trigger the integer overflow in secure boot processing, writing out-of-bounds memory to corrupt boot integrity or system state, resulting in device denial of service or reboot. No public exploit code has been identified, and the requirement for both physical access and local account credentials makes opportunistic exploitation unlikely in typical consumer or enterprise environments; exploitation is primarily relevant to insider threats or scenarios where device security perimeter has already been breached.