MediaTek TFA CVE-2026-20472

Exploitation requires the attacker to already hold System privilege on the target Android device - the highest privilege tier in the Android permission model, typically accessible only to core OS processes or via a separate privilege escalation exploit chain. The vulnerability is local only (AV:L); no network path to exploitation exists. The affected TFA component must be present, which is specific to devices using MT6986D, MT6986, or MT6982VB chipsets. No user interaction is required once System privilege is obtained. Exploitation is limited by: (1) mandatory pre-existing System-level access, (2) local-only attack surface, and (3) availability-only impact with no data exfiltration or code execution outcome beyond denial of service.

Real-world risk is low. The CVSS 3.1 score of 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H correctly reflects that exploitation requires local access and pre-existing System-level privilege - the highest Android privilege tier, which an attacker would need to already possess through separate compromise. The only outcome is a denial of service (availability impact High); there is no confidentiality or integrity impact. EPSS at 0.14% (4th percentile) signals near-zero observed exploitation activity in the wild. SSVC confirms Exploitation=none and Automatable=no, reinforcing that this is not a viable remote or automated attack path. The CVSS signals are internally consistent with the description: this is a privilege-chaining dead-end - an attacker who already holds System privilege gains little by triggering a local crash. This is a real-but-low-priority firmware hardening issue rather than a critical threat.

An attacker who has already achieved System-level privilege on an Android device running an affected MediaTek chipset (MT6986D, MT6986, or MT6982VB) could trigger the out-of-bounds write in the TFA component to corrupt memory and crash the device, resulting in a forced reboot or persistent denial of service. No public proof-of-concept code has been identified. Because System privilege is required as a precondition, this scenario would follow a multi-stage attack where a separate, more critical privilege escalation vulnerability is first exploited.