MediaTek Telephony CVE-2026-20462

Exploitation explicitly requires that the attacker has already obtained System-level privilege on the target Android device - this is stated directly in the CVE description ('if a malicious actor has already obtained the System privilege') and is reflected in the CVSS PR:H metric. The device must be running one of the 22 affected MediaTek chipsets with the unpatched Telephony firmware. No user interaction is required once System privilege is held (UI:N). Exploitation is strictly local (AV:L): there is no network-facing attack surface - remote exploitation is not possible without a separate, preceding chain of access and privilege escalation exploits. The primary factor limiting exploitation is the PR:H prerequisite; an attacker operating at user-level or below cannot directly trigger this vulnerability. The unchanged scope (S:U) means the impact is confined to the compromised device and does not inherently propagate to other networked systems.

The CVSS 3.1 score of 6.7 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H accurately characterises the threat: while the potential impact is severe (full C/I/A compromise), the PR:H prerequisite - requiring the attacker to already hold System-level privilege - is the dominant risk limiter. This is a privilege-chaining vulnerability, not an initial access vector. The AC:L rating indicates that once the System-privilege threshold is crossed, triggering the overflow is straightforward. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified statistically. The vulnerability is not listed in the CISA KEV catalogue, and no public proof-of-concept has been identified, both of which support a lower near-term exploitation likelihood. Real-world risk is highest for OEM manufacturers and enterprise Android fleet operators who must integrate MediaTek-supplied patches into device firmware and push OTA updates - a process that historically introduces deployment latency. The constrained local attack surface and high privilege prerequisite make opportunistic mass exploitation implausible; targeted post-compromise use within a multi-stage chain is the credible threat model.

An attacker who has already compromised an affected MediaTek-powered Android device and obtained System-level privilege - for example, through a malicious pre-installed application or a prior local privilege escalation exploit targeting a separate vulnerability - delivers specially crafted input to the Telephony subsystem, triggering the heap buffer overflow and corrupting adjacent heap structures. With AC:L once the privilege threshold is met, the attacker leverages the memory corruption to overwrite a function pointer or similar control-flow structure within the Telephony process, redirecting execution to attacker-controlled code at a higher privilege tier. No public proof-of-concept has been identified, but the low attack complexity rating suggests that a technically capable actor could develop reliable exploit code against a known-vulnerable firmware build.