MediaTek WLAN Driver CVE-2026-20456

The attacker must have a valid local user account on the target device with at minimum standard (non-root) user privileges, as confirmed by CVSS PR:L. The device must be equipped with one of the affected MediaTek chipsets (MT7921, MT7922, MT7925, MT7927, MT7902, MT7920) and the WLAN STA (Wi-Fi station/client) driver must be loaded and active - this is the default operating mode for any device connecting to a Wi-Fi network, making the condition met in virtually all standard deployments. No network-adjacent or remote access is required (AV:L); the attacker must have local shell access or equivalent. No interaction from another user is required (UI:N). Exploitation is limited by the absolute requirement for local authenticated access - remote unauthenticated exploitation is not possible under this attack vector. The unchanged scope (S:U) further bounds the impact to the local system only, preventing privilege escalation or lateral movement via this vulnerability alone.

CVSS 5.5 Medium with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a local, low-complexity, low-privilege attack with exclusively availability impact and unchanged scope. Real-world risk is moderate-to-low for most enterprise environments where local shell access is restricted: the attack vector is local only (AV:L), ruling out network or remote exploitation. The impact is confined to denial of service - no confidentiality or integrity loss (C:N/I:N). However, the low attack complexity (AC:L) and absence of required user interaction (UI:N) mean that any authenticated local user can trigger the crash reliably without needing to chain additional conditions. On shared systems, multi-tenant platforms, Android devices with untrusted app execution, or kiosk deployments, this is a meaningful stability risk. No EPSS score was provided in the available data, so exploitation probability cannot be quantified numerically. The vulnerability is not in the CISA KEV catalog, and no public proof-of-concept has been identified, both of which reduce urgency relative to the CVSS score alone. This is a genuine medium-priority issue - not a theoretical high-CVSS edge case - but patching priority should be elevated only for deployments with untrusted local users on affected hardware.

A low-privileged local user on a laptop equipped with a MediaTek MT7921 or MT7922 Wi-Fi chipset - operating in standard station (client) mode - submits a crafted request to the WLAN STA driver, such as a malformed ioctl call, that bypasses the missing bounds check and triggers an out-of-bounds write into adjacent kernel memory, crashing the system. No public proof-of-concept exploit code has been identified, but the low attack complexity (AC:L) and no required user interaction (UI:N) suggest the crash condition is reproducible once the triggering input is characterized. The result is a local denial of service: system crash or driver reset requiring reboot.