MediaTek Chipset CVE-2026-20466

Physical access to the target device is the explicit, non-negotiable prerequisite - CVSS AV:P confirms this. The vulnerable process is secure boot (sec boot), which executes during early device initialization before the operating system is loaded, meaning exploitation must be performed via pre-OS interfaces such as USB fastboot, JTAG debug ports, or direct flash memory access. No software-level authentication is required (PR:N per CVSS), as the attacker operates at a firmware layer where OS-level access controls are not yet active. User interaction is not required (UI:N). Exploitation is limited to four specific chipset models: MT2737, MT6880, MT6890, and MT6990. Remote or network-based exploitation is categorically not possible. The primary limiting factors for defenders are: physical access controls on the device, bootloader lock enforcement by the OEM, and disabling hardware debug interfaces in production firmware.

The CVSS 3.1 vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N yields a 6.1 score - moderate overall, but the high C and I sub-scores indicate full compromise of the boot trust chain is feasible once physical access is obtained. The physical attack vector (AV:P) is the dominant risk-limiting factor: this cannot be triggered remotely, over a network, or via any software-only path, which is directly reflected in the EPSS score of 0.16% at only the 6th percentile. No CISA KEV listing and no known public POC further confirm this has not transitioned to widespread exploitation. The absence of a scope change (S:U) indicates the attacker's impact is bounded to the vulnerable system itself rather than pivoting to adjacent infrastructure. Real-world priority is therefore moderate for device manufacturers and organizations with strict physical device security requirements (e.g., mobile device management fleets, IoT deployments), and low for cloud or server environments. The AC:L rating indicates no special timing or race condition is required once physical access is achieved, meaning exploitation is technically straightforward for a skilled attacker once the physical barrier is overcome.

An attacker who obtains physical possession of a device running an affected MediaTek chipset - for example, through theft, a checkpoint inspection, or insider access - connects via a hardware debug interface such as USB in fastboot mode or JTAG to interact with the device before the OS loads. By supplying a specially crafted payload during the secure boot process, the attacker triggers the heap buffer overflow, corrupting boot verification state and bypassing the secure boot chain to load unsigned firmware or a malicious bootloader with elevated privileges. No public exploit code or proof-of-concept has been identified at the time of analysis, but the AC:L rating indicates no special conditions beyond physical access are required for a skilled attacker.