MediaTek Telephony CVE-2026-20470

Exploitation requires that an attacker have local code execution on the device, specifically a malicious or compromised application installed on the target Android device running an affected MediaTek chipset (any of the 42 SKUs listed). The CVSS vector PR:N confirms no Android permissions or elevated privileges are required - any installed app, even one with minimal declared permissions, can invoke the exported Telephony component. No non-default system configuration is required; the improper export is present in standard MediaTek Telephony builds on affected chipsets. Exploitation is bounded by: (1) physical or social-engineering access to get an app onto the device, (2) the device must use one of the 42 named MediaTek chipsets, and (3) the OEM must not have independently corrected the export in their Android build. Remote unauthenticated exploitation is not possible - local presence is mandatory.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 6.2, which is consistent with the attack profile: local vector limits exposure relative to network-accessible flaws, but the absence of any privilege requirement (PR:N) and lack of user interaction (UI:N) means any installed application - including those with only INTERNET permission - can potentially invoke the exposed component. The C:H rating indicates meaningful telephony data is accessible, not just benign metadata. EPSS at 0.15% (5th percentile) strongly suggests no observed automated exploitation attempts, and the absence from CISA KEV corroborates this. However, this class of vulnerability is attractive to spyware and stalkerware operators who already have device-local presence through a sideloaded app. The realistic threat actor is a malicious or trojanized app rather than a remote opportunistic attacker. The sheer number of affected chipset SKUs (42 models listed) increases aggregate exposure across the Android ecosystem, particularly in markets where MediaTek dominates mid-range and budget segments.

An attacker distributes a malicious Android application - potentially disguised as a utility or game - targeting devices running on an affected MediaTek chipset. Once installed, the app calls the improperly exported Telephony component without requesting sensitive permissions, silently reading subscriber identifiers (IMSI), call records, or SIM data and exfiltrating it to a remote server. No user interaction is required after installation, and the access leaves no visible indicators on the device.