MediaTek Chipset CVE-2026-20464

Exploitation requires the attacker to have already obtained System-level privilege on the target device running an affected MediaTek chipset (MT6761, MT8766, or MT8768). This is a hard prerequisite stated explicitly in the CVE description - this vulnerability is not exploitable by an unprivileged or low-privilege attacker. The HEVC decoder must be reachable from the System privilege context, which is typical on Android devices using these chipsets. No user interaction is required once System privilege is held. Factors limiting exploitation: the System-privilege prerequisite means this is exclusively a second-stage chaining vulnerability; an initial exploitation vector granting System access must be identified and used first. No special network exposure of the device is required beyond the attacker's existing System-level foothold. Devices that have applied OEM firmware updates incorporating patch ALPS11104718 are not exploitable.

Despite a moderate NVD CVSS score of 6.5, the real-world risk profile requires careful decomposition. The CVSS vector AV:N/AC:L/PR:H/UI:N correctly captures that System-level privilege is a hard prerequisite - this is not a standalone remote exploit. An attacker must first compromise the device to System privilege through a separate vulnerability before this flaw becomes exploitable, making it a chaining vulnerability rather than a first-stage entry point. The SSVC Technical Impact of 'total' reflects the potential for full system compromise once triggered, creating a significant asymmetry: the prerequisite bar is high, but the reward for clearing it is substantial. EPSS at 0.18% (8th percentile) and SSVC 'Exploitation: none' both indicate no observed exploitation as of analysis date, with CISA KEV not listing this CVE. The CVSS AC:L rating warrants scrutiny - while exploitation of the OOB write itself may be mechanically straightforward once System privilege is held, the compound attack (chaining two exploits) materially increases real-world complexity. No conflation of POC availability with active exploitation is warranted; neither is confirmed.

An attacker who has already compromised a MediaTek MT6761, MT8766, or MT8768-based Android device to System privilege - for example via a separate unpatched vulnerability in a privileged system service - crafts a malformed HEVC video bitstream that triggers an integer overflow in the decoder. The resulting out-of-bounds write corrupts memory structures accessible from the System context, enabling code execution at a privilege level above System (potentially kernel or TEE level). No public proof-of-concept exploit code for this specific CVE has been identified at time of analysis.